ScanMalware.com

Security Scan Report: zamzamksa.com

Submitted: Oct 12, 2026, 12:12:44 AMCompleted: Oct 12, 2026, 12:13:56 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 90%

9
Risk Score

Compromised WordPress medical site now serving a ClickFix fake-CAPTCHA kit that pushes malware commands; analyst-vetted kit match plus malware-tagged domain — do not interact.

Risk Factors (4)
Known ClickFix fake-CAPTCHA malware delivery kit present in the page body
Injected third-party gambling/SEO spam content on a compromised WordPress install
Fake CAPTCHA masquerading as Cloudflare human verification to induce command execution
Malware-tagged primary domain in threat intelligence
Domain age information unavailable

Details

Page Title

zamzam medical complex – مجمع زمزم الطبي العام

Scan Type

public

Domain Name Analysis

The domain 'zamzamksa.com' uses the commercial generic top-level domain (.com) with no subdomain. Its registrable label 'zamzamksa' stretches across 9 characters containing 3 vowels alongside 6 consonants. Word splitting yields three words: zam, zam, ksa. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://zamzamksa.com

Page Load Overview

36.68s
Total Load Time
15.2 MB
Total Size

Language Analysis

Primary Language

🇸🇦Arabic
Code: ar
Confidence:80%
Script:Arabic
Direction:rtl

Detection Details

HTML Lang Attribute:ar
Text Length:2,665 chars
Detector Agreement:50%

Website Classification

Primary Category

finance banking48% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

finance banking
48%
news/blog
20%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1250.87.197.86Phoenix, Arizona, United States
AS46606Unified Layer
5142.251.13.95Google · CDNUnited States
AS15169Google LLC
5142.251.20.94Google · CDNUnited States
AS15169Google LLC
5142.251.14.94Google · CDNUnited States
AS15169Google LLC
5104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
552.63.121.74Aws · CLOUDSydney, New South Wales, Australia
AS16509Amazon.com, Inc.
5142.251.150.119Google · CDNUnited States
AS15169Google LLC
5142.251.110.103Google · CDNUnited States
AS15169Google LLC
5104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.153.119Google · CDNUnited States
AS15169Google LLC
6211--

Detected Technologies8

WordPressv7.1.3
100%
MetaGenerator
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%
Bluehost
40%
WordPress Block Editor
30%
ThemeGrill ColorMag
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12303244123E1C8FD76DFAF691B2DE788530BAD01C5895FDBB43AE054624DA8588B3F06

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:VWK0eJ0pi36DdXiLLdhaG5AHRdFwZdypU:VUeJ0pi36DdXiLLdhaG5OeypU

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:39678:4BdKVAhuEzoRAOUAOWQQqWAUCECOQBMCPA8QABMSckEkgEiAMqEMMpkHCSksKgChmGGQADtAgMkPlBgQzDZ0IgLMAWBIIhKR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fbf9fbffffffe7c3
Perceptual Hash:e1cd61ce30969cb3
Difference Hash:121203000a004d9e
Wavelet Hash:f8f9f1ff00000000
Color Hash:#8c40bf

Other Hashes

Crop Resistant:121203000a004d9e,9f2b23336627399f,0f9b212c5c78746f

Scan History

Scan history not available

Unable to load historical scan data