ScanMalware.com

Security Scan Report: ftp.karmanorbuling.org

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ebf1e19f-e7d3-4241-b41f-b1373368c3a5Domain and IP registration (RDAP)/api/v1/rdap/ebf1e19f-e7d3-4241-b41f-b1373368c3a5How often this domain was scanned/api/v1/domain/stats/ftp.karmanorbuling.orgScan history for this domain/api/v1/domain/history/ftp.karmanorbuling.org?limit=15
This website contacted 4 IPs in 2 countries across 5 domains to perform 2 HTTP transactions. The main domain is karmanorbuling.org and was registered 3 years 5 months ago.

Submitted URL: https://ftp.karmanorbuling.org

AI Security Verdict

High Risk

Confidence: 68%

7
Risk Score

Legit-looking home-maintenance landing page with no forms, but the primary domain carries a single-source Agent Tesla malware Indicator of Compromise, which forces HIGH_RISK pending verification.

Risk Factors (3)
Primary-domain Indicator of Compromise: Agent Tesla malware/stealer report (single-source, unverified)
Domain unranked in Cisco Umbrella top 1M
Page content does not correspond to the hosting domain's apparent owner
Domain age information unavailable

Details

Page Title

Home Maintenance in Kuala Lumpur | Double Aother network

Scan Type

public

Domain Name Analysis

Within the non-profit oriented generic top-level domain (.org), 'ftp.karmanorbuling.org' is registered with subdomain 'ftp'. Its registrable label 'karmanorbuling' stretches across 14 characters containing five vowels alongside 9 consonants. Splitting it apart reveals 3 words: karma, norbu, ling. Median word length is five characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ftp.karmanorbuling.org

Page Load Overview

78.84s
Total Load Time
54 KB
Total Size

Language Analysis

Primary Language

🇻🇳Vietnamese
Code: vi
Confidence:50%
Script:Unknown
Direction:ltr

Detection Details

Text Length:10,000 chars
Detector Agreement:100%

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2142.251.13.97Google · CDNUnited States
AS15169Google LLC
0218.208.91.137Kuala Lumpur, Kuala Lumpur, Malaysia
AS4788TM TECHNOLOGY SERVICES SDN. BHD.
013.33.187.25Cloudfront · CDNNew York, New York, United States
AS16509Amazon.com, Inc.
0142.251.127.84Google · CDNUnited States
AS15169Google LLC
04--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D5B2E8F3592D1509BB8E834E81C3B11CE048A586E651E7BAF5F1600DDEF8AF600EB539

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:2SApF7C6Dd8eLGeUhXJdCJPU122NYQegS:3Aq6D2/eKXJdKPl6zS

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:24105:MZUHOIFAeAbDCHnLPZOCJggTGUQBwjBGGWYJfkgGAWFCwBhbTgAAtIhgG8qUCI5mo4DCMwA0EsJgDFAAhXgFxDng1PIsnUUA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:819fffffffffffff
Perceptual Hash:ed6d6d6d69694900
Difference Hash:2220000000000000
Wavelet Hash:000d0303f3f3f1ff
Color Hash:#5382ac

Other Hashes

Crop Resistant:2220000000000000

Scan History

Scan history not available

Unable to load historical scan data