Security Scan: Maintenance

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/05b5e0bc-1d2c-45cb-a70a-5649466d98cd Domain and IP registration (RDAP)/api/v1/rdap/05b5e0bc-1d2c-45cb-a70a-5649466d98cd Certificate Transparency/api/v1/ct/keyworksrl.it How often this domain was scanned/api/v1/domain/stats/keyworksrl.it Scan history for this domain/api/v1/domain/history/keyworksrl.it?limit=15

This website contacted 1 IP in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is keyworksrl.it and was registered 6 years ago.

Submitted URL: https://keyworksrl.it/wp-content/plugins/wp-required-integumentary/index.php?r=bd1odhrwczovl2nsb3vkmjaymc1wb29sltewotgtdm9sdw1llnmzlnvzlwvhc3qtms5hbwf6b25hd3muy29tlzzldgvyvgxrvczlbt1pbmzvqghvbgxlci1wbgfudw5nlmrl

AI Security Verdict

High Risk

Confidence: 72%

Risk Score

Compromised legitimate WordPress site abusing a fake plugin (wp-required-integumentary) with a base64-encoded S3 redirect parameter; flagged by threat intel as Latrodectus malware dropper. Avoid.

Risk Factors

Obfuscated base64-encoded URL parameter redirecting to an external Amazon S3 bucket

Threat-intel match classifying the URL as Latrodectus malware

Suspicious/unrecognized WordPress plugin directory hosting a dropper script

Maintenance overlay likely masking the compromised site's real function

Domain age information unavailable

Details

Page Title

Maintenance

Scan Type

public

Favicon Hash

MMH3: 349681291

MD5: 0d2d8e47b24ead9c8d67c0aece843c56

Domain Name Analysis

Domain 'keyworksrl.it' uses the Italian country-code top-level domain (.it) and has no subdomain. The second-level label 'keyworksrl' is 10 characters long containing two vowels alongside 8 consonants. Tokenizing the label suggests three words: key, works, rl. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.04s

Total Load Time

78 KB

Total Size

Language Analysis

Primary Language

🇮🇹Italian

Code: it

Confidence:42%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:506 chars

Detector Agreement:100%

Language mismatch: Declared as en but detected as it

Website Classification

Primary Category

government public service91% confidence

Type: static

Method: ml+structural

All Detected Categories

government public service

91%

documentation technical

85%

healthcare medical

83%

cryptocurrency blockchain

82%

real estate property

78%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	31.11.36.35	Arezzo, Tuscany, Italy	AS31034Aruba S.p.A.
2	1	-	-

Detected Technologies3

X-UA-Compatible

100%

HTTP/3

40%

Aruba.it

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14F537D1B0314CB9AFEAC442CA595144ABAD0D89394A4E1C4BB9F900ADFDC4F4E59DBEC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:DwVCxBVx9OMzL/Rku8cjShPXjuk0SWPUo5YNEaKfj:RxvbzL/RkhHXjuLlUoSOL

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:64592:mBdoAAMSABkwLawISYgQBiAQjSE6Q7SABNRBQG1UAQKlQhV4TMBgFGwx7iAMUIGjFgMrIINwkRSP5AgEJAAyYE5IkZISJQlk

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:5f8b8b818bffffff

Perceptual Hash:b9399696694d9692

Difference Hash:903a3a323a001000

Wavelet Hash:0081818184fcfcfc

Color Hash:#be79d2

Other Hashes

Crop Resistant:903a3a323a001000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: keyworksrl.it