ScanMalware.com

Security Scan Report: thinkoutsidetheball.substack.com

Site favicon
Submitted: Jun 14, 2026, 11:46:25 PMCompleted: Jun 14, 2026, 11:47:20 PMpubliccompleted
Loading additional data...

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 2 HTTP transactions. The main domain is thinkoutsidetheball.substack.com and was registered NaN years ago.

Submitted URL: https://thinkoutsidetheball.substack.com/p/world-cup-day-4-ranking-almost-all

The Cisco Umbrella rank of the primary domain is #9,753 of the top 1 million websitesTop 10K Site

AI Security Verdict

Low Risk

Confidence: 95%

2
Risk Score

Legitimate news article on a long‑standing Substack domain with no phishing or malware indicators.

Risk Factors
High JavaScript obfuscation score (potentially suspicious)
Multiple email collection forms
Safety Factors
Established domain reputation and age
No malicious IoC or YARA detections
No IDS alerts or network‑level threats
Content classified as news/blog by ML with high confidence
Domain age information unavailable

Details

Page Title

World Cup Day 4: Ranking (almost all) the stadiums

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Category

news/blog

(100%)

Domain Information

The domain name 'thinkoutsidetheball.substack.com' uses the commercial generic top-level domain (.com) with subdomain 'thinkoutsidetheball'. The core label 'substack' covers 8 characters split between 2 vowels and 6 consonants. Breaking it apart gives 2 words: sub, stack. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://thinkoutsidetheball.substack.com/p/world-cup-day-4-ranking-almost-all

Page Load Overview

10.05s
Total Load Time
329
HTTP Requests
11
Domains
3.4 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:en
Text Length:24,192 chars
Detector Agreement:80%

Website Classification

Primary Category

news/blog100% confidence
Type: spa
Method: structural

All Detected Categories

news/blog
100%
corporate
70%

Detected Features

Articles
Comments
OG: article
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
69151.101.194.217United States
AS54113Fastly, Inc.
65157.240.0.174Frankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
65142.251.20.94United States
AS15169Google LLC
65104.18.37.200United States
AS13335Cloudflare, Inc.
6518.64.211.2United States
AS16509Amazon.com, Inc.
3295--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16F84D9B285A1941F464695E8A1FFFB0C61CBC23B56B5CAF47CFC447013C6C63692B6A2

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:fK3lfklmtOrGUnrMs3Mz3mwxP9S7pTHMSsXIKSAvEUxwcMro3Gj8eb46X338tr2O:fyjYrGwrMpxuBHMSsXVSIntv

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:379339:A7XECiKIEipErwCjMkAKEBiAAcADQFhWFUFxwiGxkUhkRduJRIhdQJAFMFgolOEQaDKwUIgKHgZCCxUMACVkCFMHUmWCFCUQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c4c7dfc3c3e7e7c3
Perceptual Hash:f65852567046d2de
Difference Hash:0c1616160e0c0d1e
Wavelet Hash:c0c3c3c3c3e7c3c3
Color Hash:#9653ac

Other Hashes

Crop Resistant:0c1616160e0c0d1e

Scan History

Scan history not available

Unable to load historical scan data