Security Scan Report: medmark.sa

Submitted: Sep 13, 2026, 2:47:32 PMCompleted: Sep 13, 2026, 2:48:15 PMpubliccompleted

Summary

This website contacted 14 IPs in 5 countries across 12 domains to perform 2 HTTP transactions. The main domain is medmark.sa and was registered 21 years ago.

Submitted URL: https://medmark.sa

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Compromised/malicious WordPress site (10-day-old medmark.sa) serving EtherHiding malware C2 and exploit-kit resources from flagged domains, confirmed by CRITICAL IDS and multi-feed threat intel.

Risk Factors
Domain only 10 days old with no established reputation
Exploit-kit and malware-flagged domains loaded as page sub-resources
EtherHiding exfiltration pattern consistent with a compromised WordPress site repurposed for malware distribution
Obfuscated inline JavaScript generating code at runtime
Blockchain RPC endpoints used for covert command-and-control
Domain age information unavailable

Details

Page Title

MED MARK

Scan Type

public

Language

🇸🇦

Arabic

(80% confidence)

Category

entertainment media

(98%)

Domain Information

Within the Saudi country-code top-level domain (.sa), 'medmark.sa' is registered without a subdomain. The registrable portion 'medmark' spans 7 characters holding 2 vowels versus 5 consonants. Tokenizing the label suggests two words: med, mark. Average segment length settles at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://medmark.sa

Page Load Overview

20.00s
Total Load Time
33
HTTP Requests
12
Domains
128 KB
Total Size

Language Analysis

Primary Language

🇸🇦Arabic
Code: ar
Confidence:80%
Script:Arabic
Direction:rtl

Detection Details

Language Code:ar
Detection Confidence:80%
Script Type:Arabic
HTML Lang Attribute:ar
Text Length:1,111 chars
Detector Agreement:50%

Website Classification

Primary Category

entertainment media98% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

entertainment media
98%
gambling betting
96%
healthcare medical
91%
government public service
90%
corporate business
66%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
780.238.228.43Riyadh, Riyadh Region, Saudi Arabia
AS136907HUAWEI CLOUDS
2172.67.130.228Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.21.43.2Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.20.95Google · CDNUnited States
AS15169Google LLC
2172.67.215.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
2192.178.170.95Google · CDNUnited States
AS15169Google LLC
2104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
235.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
2188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3314--

Page Statistics

33
Requests
13
Unique Domains
355.3 KB
Total Size

Detected Technologies8

JQueryv3.7.1
100%
50%
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DC625532E09841667F5EC77DC1E1B328E9A8B704DE06776A70F431689A98AF700F721D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:Qi5067j+2OQtoq/rqwRXdSZsTaAg1BNslQCfEGHRmy4kWL7:X5o2/oqr/ZdSZUaAskWL7

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:15833:SEQHAxFkEKyiBjUIBLRdKUbQJODDWQSOAQAAhJkUAM4EMRZg5NFUgRkBgfEFSmrYhyFKuCKIhoCIDgImaKBIRIhqMKxIqnGs

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fefefefefeffffff
Perceptual Hash:d555aaaa55aaaa54
Difference Hash:0000000000000000
Wavelet Hash:0e0e0e0e0e0e0e0e
Color Hash:#53ac75

Other Hashes

Crop Resistant:0000000000000000

Scan History

Scan history not available

Unable to load historical scan data