ScanMalware.com

Security Scan Report: mr-ansarian.ir

Submitted: Sep 13, 2026, 5:47:29 PMCompleted: Sep 13, 2026, 5:47:58 PMpubliccompleted

Summary

This website contacted 21 IPs in 3 countries across 11 domains to perform 1 HTTP transaction. The main domain is mr-ansarian.ir and was registered 1 week ago.

Submitted URL: https://mr-ansarian.ir

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

5-day-old self-branded personal site is delivering malware: a CRITICAL EtherHiding malware IDS hit, Ethereum-contract/blockchain-RPC staging, obfuscated JS and loaded ClearFake/exploit-kit IoC domains. No forms present, but do not visit.

Risk Factors
CRITICAL Suricata alert: ET MALWARE EtherHiding Exfil M2 (network trojan)
Multiple corroborated malware/exploit-kit IoC domains loaded as sub-resources (ClearFake ek, iClickFix)
Blockchain RPC + Ethereum contract getDomain() requests consistent with EtherHiding C2 staging
Obfuscated JavaScript with dynamic code generation (Function() constructor) and crypto/encoding APIs
Domain registered only 5 days ago (CRITICAL age category)
Domain age information unavailable

Details

Page Title

مجموعه پیمان کاری حمید انصاریان - مجموعه پیمان کاری حمید انصاریان

Scan Type

public

Language

🇮🇷

FA

(80% confidence)

Category

blog personal website

(99%)

Domain Information

The domain name 'mr-ansarian.ir' uses the Iranian country-code top-level domain (.ir) without a subdomain. Count 11 characters in 'mr-ansarian' holding four vowels versus 6 consonants, plus 1 hyphen. It segments into 3 words: mr, ansari, an. Expect two characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://mr-ansarian.ir

Page Load Overview

6.72s
Total Load Time
60
HTTP Requests
11
Domains
1.1 MB
Total Size

Language Analysis

Primary Language

🇮🇷Persian
Code: fa
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

Language Code:fa
Detection Confidence:80%
Script Type:Unknown
HTML Lang Attribute:fa-IR
Text Length:1,282 chars
Detector Agreement:100%

Website Classification

Primary Category

blog personal website99% confidence
Type: spa
Method: ml+structural

All Detected Categories

blog personal website
99%
documentation technical
89%
government public service
86%
cryptocurrency blockchain
77%
technology software
77%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
20172.67.215.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
2185.7.212.182Iran
AS60631Vandad Vira Hooman LLC
2150.136.141.142Oracle · CLOUDAshburn, Virginia, United States
AS31898Oracle Corporation
2142.251.13.101Google · CDNUnited States
AS15169Google LLC
2172.67.130.228Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.250.154.95Google · CDNUnited States
AS15169Google LLC
235.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
2172.66.164.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.14.94Google · CDNUnited States
AS15169Google LLC
6021--

Page Statistics

60
Requests
11
Unique Domains
1.4 MB
Total Size

Detected Technologies8

X-UA-Compatible
100%
Open-Graph-Protocolvwebsite
100%
JQueryv3.6.4
100%
WordPress
90%
PHP
50%
MySQL
50%
particles.js
20%
Google Maps
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18462F29303B41EAC625048DAC05E3A5656F6D56B2C5CABDCBCE26E17BC3FF109646A30

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:DIFhifSWNlA73ES/SyuO/2JweTXl6nKUTsOXA2EvZBIhKEUZD+rOCsteF+uTlAAi:DSES/S/xjl6nlAjMKEmQv9woHEgPCn0E

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:15321:ddyBBAgMGnF1YCjARIDSICbtNZIAglwCMAIWUDMTxIwJFAgFDCygQQEwTBZoQGASBwgAALBECagYEAgQGBYq6sFQiIkIhUBG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:cfc0c8f86466e4e4
Perceptual Hash:f1a9b6a38a9d312a
Difference Hash:d59592518dcec8e8
Wavelet Hash:efc4c8fc6066a4e4
Color Hash:#8153ac

Other Hashes

Crop Resistant:d59592518dcec8e8

Scan History

Scan history not available

Unable to load historical scan data