Scan report · 2 days agoPublic

arabma.com

92.205.2.188AS21499 · DE

Submittedhttps://arabma.com

Landed onhttps://arabma.com/

Verdict

2 of 8 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

StrongThe host is serving the operator's own files

/shell.php (source/secret file) · /wso.php (source/secret file) · /backup.sql (source/secret file) · /victims.txt (credential log)

We asked this host for a short list of paths that a correctly deployed site never answers, and it served them: the kit's own archive, its credential or session log, or a source/secret file. These are the operator's working files, left readable by anyone.

Analyst noteOpen each path shown above before it disappears — a credential or session log names the victims, an exfil config names where the stolen data goes, and an archive usually contains the whole kit. Capture them as evidence for the takedown; this host is reachable by everyone else too.

File

The file was not analysed, so the scan carries no verdict on the file itself.

Infrastructure

IP: 92.205.2.188GODADDY-SXB - Host Europe GmbH, DE · AS21499DE
TLS: CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US · expires Nov 14, 2026
Redirects: 0 hops · / → /

WHOIS

Registrar: GoDaddy.com, LLC
Created: Jan 7, 2002
Expires: Jan 7, 2028
Nameservers: ns03.domaincontrol.comns04.domaincontrol.com

51 malicious11 suspicious

Hashes & fingerprints

Page Hashc4bc4534754b08dff8bf8af1d91e5f8b9f29677d9e2e7c5f252c0827361033a4 Screenshot pHashf0f00f1f0fe0f0f0 JARM2ad2ad16d2ad2ad0002ad2ad2ad2adbfb4c26e4a72aca380107db225a1ef64 JA4X2166164053c1_7022c563de38_54872e220c05 Cert Thumbprint6C8B3F8BEDDF09EE76A9BD1C65E06F781162DB35 Cert IssuerCN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Page capture

Live

Title “ووردبريس › خطأ”

Visit Site

Engines

8 · time to verdict