www.hotelrefah.com - URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned www.hotelrefah.com and returned a unknown verdict (score -6). The page resolved to 185.143.233.238 on AbrArvan BGP Anycast in IR. The domain was registered 2536 days ago through CSL Computer Service Langenbach GmbH d/b/a joker.com. 9 domains and 3 IPs were contacted, over 11 HTTP requests. The request followed 3 redirects before landing. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -6) · Confidence 12%
- Scanned URL:
http://hotelrefah4ter.ir/basefile/hotelrefah4terir/files/24316857649.pdf - Domain: www.hotelrefah.com · IP: 185.143.233.238 · AS205585 · IR
- Server: ArvanCloud
- Page title: هتل چهار ستاره رفاه مشهد - هتل رفاه مشهد -hotelrefah
- HTTP status: 200 · text/html; charset=utf-8
- Registrar: CSL Computer Service Langenbach GmbH d/b/a joker.com · domain age 2536 days · created 2019-09-10
- TLS issuer: C=US, O=Let's Encrypt, CN=YE2 · valid to Oct 20 05: · subject CN=hotelrefah.com
- HTTP requests captured: 11
- Scan tier: standard · observed 2026-08-21 01:32:13 UTC
Redirect chain
http://hotelrefah4ter.ir/basefile/hotelrefah4terir/files/24316857649.pdfhttp://hotelrefah4ter.ir/basefile/hotelrefah4terir/files/24316857649.pdf/http://hotelrefah.com/basefile/hotelrefah4terir/files/24316857649.pdf/https://www.hotelrefah.com/basefile/hotelrefah4terir/files/24316857649.pdf/
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Cross-host redirect chain
Detected technologies
- ASP.NET
- jQuery
- Bootstrap
Contacted infrastructure
- 185.143.233.238 - AS205585 AbrArvan BGP Anycast (Iran, Islamic Republic of)
- 212.23.216.150 - AS43754 Parsway Shomal Company Ltd (Iran, Islamic Republic of)
- 185.143.234.238 - AS205585 AbrArvan BGP Anycast (Iran, Islamic Republic of)
Observed indicators
- www.hotelrefah.com
- menu.hotelrefah.com
- badesaba.ir
- hotelrefah.asabooking.com
- web.whatsapp.com
- instagram.com
- t.me
- goo.gl
- www.intechdev.com
- 185.143.233.238
- 212.23.216.150
- 185.143.234.238
- https://www.hotelrefah.com/basefile/hotelrefah4terir/files/24316857649.pdf/
- https://www.hotelrefah.com/Images/favicon.ico?t=3
- https://www.hotelrefah.com/plugins/bootstrap-5.0.2/src/bootstrap.rtl.min.css
- https://www.hotelrefah.com/plugins/swiper-5.4.5/css/swiper.min.css
- https://www.hotelrefah.com/plugins/swiper-5.4.5/css/swiper-bundle.min.css
- https://www.hotelrefah.com/plugins/fontawesome-pro-5.5.0-web/css/all.min.css
- https://www.hotelrefah.com/plugins/imageeffectck/imageeffectck.css
- https://www.hotelrefah.com/plugins/faAnimation/font-awesome-animation.min.css
Questions about www.hotelrefah.com
- Is www.hotelrefah.com safe?
- The scan of www.hotelrefah.com on 21 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.
- How was www.hotelrefah.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the standard tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.hotelrefah.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan