ScanMalware.com

Security Scan Report: sonivision.es

Site favicon
Submitted: Oct 14, 2026, 3:54:12 PMCompleted: Oct 14, 2026, 3:55:00 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Legitimate Spanish AV company site that has been compromised: it injects a ClickFix/EtherHiding loader (IClickFix kit) reading its payload from a blockchain contract and beaconing to flagged host zvh4.com. Do not visit.

Risk Factors (4)
Compromised legitimate business site injecting a ClickFix / EtherHiding malware loader
Multiple CRITICAL network IDS malware alerts and a known-malicious kit identification
Obfuscated JavaScript that decodes to known-attacker RPC/hosting endpoints and blockchain-resolved payloads
Primary domain flagged as a malware loader by threat intelligence
Domain age information unavailable

Details

Page Title

SONIVISION – Venta e instalación de sonido e iluminación

Scan Type

public

Domain Name Analysis

Domain 'sonivision.es' uses the Spanish country-code top-level domain (.es) while skipping any subdomain. Count 10 characters in 'sonivision' containing 5 vowels alongside five consonants. Splitting it apart reveals three words: son, i, vision. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://sonivision.es

Page Load Overview

5.87s
Total Load Time
3.0 MB
Total Size

Language Analysis

Primary Language

🇪🇸Spanish
Code: es
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:es
Text Length:4,082 chars
Detector Agreement:75%

Website Classification

Primary Category

news/blog40% confidence
Type: spa
Method: structural

All Detected Categories

news/blog
40%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
13212.227.229.59Spain
AS8560IONOS SE
13142.251.14.95Google · CDNUnited States
AS15169Google LLC
13142.251.20.94Google · CDNUnited States
AS15169Google LLC
13172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
655--

Detected Technologies8

WordPressv7.0.2
100%
MetaGenerator
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%
Smart Slider 3
20%
Essential Addons for Elementor
20%
Complianz
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T184142931BAA4193A116F43CBE16BB20DB2BAF717CB474AE9F1FE416807C9DF51442609

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:hRda3nSiRLqYHz59LYtj8VpeoxdZov2UNeklpdcKgfk9Hrg:hRduhdO8RdZovC

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:191676:xEBUihq0JCtGJbj3AaUuAKEgCZCgERJcgMEBwZQMDAhwAjiUAAczQIGECi6EM8xUPgLBoLMDRASpKBQxWAkGiEZyL4FKMQBw

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:38f8f8f8f34300ff
Perceptual Hash:c14f0b25f75a826e
Difference Hash:e8eaa19086825995
Wavelet Hash:3878f8f8c34300ff
Color Hash:#6ce0bd

Other Hashes

Crop Resistant:e8eaa19086825995,8e1c3af6ce10991b,7cfcf8e0c0d08061,e8eaa0901686fadc

Scan History

Scan history not available

Unable to load historical scan data