Security Scan Report: alambiodiversitasindonesia.or.id

Site favicon
Submitted: Completed: publiccompleted
This website contacted 8 IPs in 3 countries across 9 domains to perform 95 HTTP transactions. The main domain is alambiodiversitasindonesia.or.id and was registered 6 months ago.

Submitted URL: https://alambiodiversitasindonesia.or.id

AI Security Verdict

Confirmed Scam

Confidence: 94%

9
Risk Score

Compromised WordPress conservation site serving ClearFake/EtherHiding malware: multiple malware Indicators of Compromise, critical ET MALWARE EtherHiding alerts, and blockchain RPC C2 resolution. Avoid.

Risk Factors (6)
Multi-feed malware Indicators of Compromise on the primary domain and root URL
Critical IDS detection of EtherHiding exfiltration (ClearFake malware family)
Blockchain RPC C2 resolution (polygon/ankr/1rpc/publicnode/blastapi/tenderly) with Ethereum getDomain() contract calls
Malicious third-party resource cloudeccentric.cc loaded by the page
Dynamic Function() constructor code generation
Legitimate WordPress non-profit site appears compromised for malware delivery
Domain age information unavailable

Details

Page Title

Alam Biodiversitas Indonesia

Scan Type

public

Domain Name Analysis

Within the Indonesian country-code top-level domain (.or.id), 'alambiodiversitasindonesia.or.id' is registered and has no subdomain. Its registrable label 'alambiodiversitasindonesia' stretches across 26 characters split between 13 vowels and 13 consonants. Splitting it apart reveals 6 words: alam, bio, divers, it, as, indonesia. Median word length is 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://alambiodiversitasindonesia.or.id

Page Load Overview

23.60s
Total Load Time
844 KB
Total Size

Language Analysis

Primary Language

🇮🇩Indonesian
Code: id
Confidence:50%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:3,633 chars
Detector Agreement:100%
Language mismatch: Declared as en-US but detected as id

Website Classification

Primary Category

news/blog40% confidence
Type: spa
Method: structural

All Detected Categories

news/blog
40%

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
18202.10.43.60Indonesia
AS58487CV. Rumahweb Indonesia
11142.250.154.95Google · CDNUnited States
AS15169Google LLC
11152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
11172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
11142.250.154.94Google · CDNUnited States
AS15169Google LLC
11188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
11172.66.164.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1135.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
958--

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F993A671B760257A323B437DE59BF60465285A13DB4E73E6F4BDC09885CABA310B1B0E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:yMu9nAlnXYWW997/+ptr9U0UdcWWbzyfGCwwyLNJjoA1l38h0pZdypawrcOEi:y9nAlnXRW9J+jr7Zyp3L

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:96336:w4sIIJJrdFIIBnJ5QzDEDhIF5GGEAJMRAZBRtGgxQQ1cGwAgB1cuiXQQAGECJQiAMZQAAIIEiIICMcKkUGgEEAymMofigC0m

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff00000000ffffff
Perceptual Hash:e613ed98ccc691e4
Difference Hash:0311c9c5e1190607
Wavelet Hash:ff00000000ffffff
Color Hash:#c2d279

Other Hashes

Crop Resistant:0311c9c5e1190607

Scan History

Scan history not available

Unable to load historical scan data