ScanMalware.com

Security Scan Report: landingham.ir

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f638b341-e8f3-40bc-8407-640035be55baDomain and IP registration (RDAP)/api/v1/rdap/f638b341-e8f3-40bc-8407-640035be55baHow often this domain was scanned/api/v1/domain/stats/landingham.irScan history for this domain/api/v1/domain/history/landingham.ir?limit=15
This website contacted 8 IPs in 2 countries across 1 domain to perform 7 HTTP transactions. The main domain is landingham.ir.

Submitted URL: https://landingham.ir

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Persian campaign-landing archive with no forms, but obfuscated scripts use EtherHiding and reference a Vidar-flagged host, plus a malware-loader indicator on the domain. Treat as malware delivery.

Risk Factors (4)
Single-source content-malware indicator on the primary domain (unknown loader)
Obfuscated JavaScript concealing references to blockchain RPC/data-seed infrastructure
Blockchain-contract-based next-stage payload resolution (EtherHiding) — deliberate anti-takedown obfuscation
Decoded script references a host flagged as Vidar malware
Domain age information unavailable

Details

Page Title

لندینگهام | لندینگ‌های مناسبتی

Scan Type

public

Domain Name Analysis

Domain 'landingham.ir' uses the Iranian country-code top-level domain (.ir). Count 10 characters in 'landingham' containing 3 vowels alongside 7 consonants. Segmentation suggests two words: land, ingham. The median word length lands at 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://landingham.ir

Page Load Overview

1.62s
Total Load Time
428 KB
Total Size

Language Analysis

Primary Language

🇮🇷Persian
Code: fa
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:fa
Text Length:226 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate50% confidence
Type: static
Method: structural

All Detected Categories

corporate
50%

Detected Features

OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7185.239.1.100Iran
AS202269BitCommand LLC
015.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
0104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
03.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
0172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
03.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
0142.215.53.55Washington, District of Columbia, United States
AS15830Equinix (EMEA) Acquisition Enterprises B.V.
052.223.48.152Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
78--

Detected Technologies3

Open-Graph-Protocolvwebsite
100%
LiteSpeed
50%
Litespeed Cache
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T152A36D66340B513D01537295F8CB9C08F955439344F6A0E7F28D8E28BAFE7C4A337A9A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:oAqBlIjDqIpNoJnAUBzTYSWv6Qu6tM6bqC6iEy5hQ/L6v/H5gc:6BGLbUBQSKB5N6a5W/L6v/H5x

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:99484:AKIhA6gotgTLRxSSPIAVGMAFhBAETEWGiBPQwAASZ0SQkKTxXUKhyLkDzNFYqE2Qa4kgVQAYrIAEQQKUsCgBBo4gJHEQKgCg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc381818181ffff
Perceptual Hash:a82e973997926867
Difference Hash:fc2b2b132b2b2bcc
Wavelet Hash:7f0181818181ffff
Color Hash:#6653ac

Other Hashes

Crop Resistant:fc2b2b132b2b2bcc,4da4b696b6844d6d

Scan History

Scan history not available

Unable to load historical scan data