Security Scan Report: banjarnegeri.id

Site favicon
Submitted: Oct 9, 2026, 8:13:35 PMCompleted: Oct 9, 2026, 8:15:27 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Legitimate-looking Indonesian news site (banjarnegeri.id) compromised with the analyst-vetted ErrTraffic/Exvicy WordPress loader; primary domain and URL carry multi-source malware Indicators of Compromise plus CRITICAL EtherHiding/ClickFix IDS alerts. Do not visit.

Risk Factors (5)
Analyst-vetted ErrTraffic/Exvicy injected WordPress loader (CRITICAL phishing kit family) present in the page HTML
Indicators of Compromise match on the primary domain and scanned URL (clearfake malware, 2 corroborating feeds)
Multiple CRITICAL Suricata IDS alerts: EtherHiding exfiltration and ClickFix domain contact
Blockchain RPC / gateway connections used for payload delivery or exfiltration (EtherHiding pattern)
Additional loaded third-party domains flagged as malicious (ohhhhhmoney.com, makeverizyjar.info, lovezramexar.info)
Domain age information unavailable

Details

Page Title

banjarnegeri.id -

Scan Type

public

Domain Name Analysis

You're looking at domain 'banjarnegeri.id' on the Indonesian country-code top-level domain (.id) and has no subdomain. The second-level label 'banjarnegeri' is 12 characters long containing five vowels alongside seven consonants. It segments into three words: banja, r, negeri. The median word length lands at 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://banjarnegeri.id

Page Load Overview

75.08s
Total Load Time
1.0 MB
Total Size

Language Analysis

Primary Language

🇮🇩Indonesian
Code: id
Confidence:50%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:10,980 chars
Detector Agreement:100%
Language mismatch: Declared as en-US but detected as id

Website Classification

Primary Category

government public service88% confidence
Type: spa
Method: ml+structural

All Detected Categories

government public service
88%
healthcare medical
79%
adult content
73%
news media journalism
69%
corporate business
62%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7103.251.44.218Indonesia
AS131775PT. Jupiter Jala Arta
5142.251.14.95Google · CDNUnited States
AS15169Google LLC
5188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
5104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.110.94Google · CDNUnited States
AS15169Google LLC
535.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
5158.94.211.226Rotterdam, South Holland, Netherlands
AS202412Omegatech LTD
5158.94.208.87Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
5192.178.183.95Google · CDNUnited States
AS15169Google LLC
8216--

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T154E31AB2108E087A5B29E7F740C47E1E510B8A36CDE6DDE3F2BACE7591C1ED147A6805

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:FDyp8V0g994RUeJ8hDwLeTsz8WO/NA/EyJm6k0+UpYhXwMCHO7Zftk0VDb4YcG2c:FuLI94GeJ8hDwLeYAWuMlvZSyiXt

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:149556:PQuFGCCqXAwOBYEIERnYB1iIH4BPnpAIEhA6IRREjQAJCXHxgiJyA4U8BBqMBoBEx2jCQJkAEFsWSjFDFKk4HCwAASKyMk+y

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe3dbc78787c7c7
Perceptual Hash:b0cdcd32988936cf
Difference Hash:968e331d1d0d0c0d
Wavelet Hash:fbc2818787878787
Color Hash:#d22d59

Scan History

Scan history not available

Unable to load historical scan data