Security Scan Report: honeybaenailz.com

Site favicon
Submitted: Oct 14, 2026, 8:00:21 PMCompleted: Oct 14, 2026, 8:01:22 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 96%

9
Risk Score

Legitimate-looking nail shop whose pages are compromised with a ClickFix 'Cloudflare Human Verification' kit and EtherHiding blockchain loader; analyst-vetted kits, critical YARA and IDS ClickFix/EtherHiding alerts confirm malware distribution.

Risk Factors (5)
Injected ClickFix 'Human Verification' overlay instructing Windows users to open Terminal and paste a command (PowerShell/ClickFix infection chain)
EtherHiding blockchain-contract-driven loader and ClickFix C2 domains (gateway.tenderly.co) seen on the wire
Obfuscated scripts hiding threat-feed RPC/blockchain hosts (1rpc.io, polygon.drpc.org, polygon.gateway.tenderly.co)
Unranked third-party script host browse-codes-enter.beer serving code to the page (consistent with compromised-site injection)
Primary domain flagged as a malware loader in threat intelligence
Domain age information unavailable

Details

Page Title

Luxury Handmade Press-On Nails | Honey Bae Nailz

Scan Type

public

Domain Name Analysis

Domain 'honeybaenailz.com' uses the commercial generic top-level domain (.com) with no subdomain. Its registrable label 'honeybaenailz' stretches across 13 characters holding six vowels versus 7 consonants. Splitting it apart reveals 4 words: honey, bae, nail, z. The median word length lands at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://honeybaenailz.com

Page Load Overview

8.72s
Total Load Time
22.9 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:7,522 chars
Detector Agreement:75%

Website Classification

Primary Category

corporate35% confidence
Type: spa
Method: ml+structural

All Detected Categories

corporate
35%
adult content
31%
entertainment media
26%

Detected Features

Search
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
23174.138.176.150New York, New York, United States
AS19318Interserver, Inc
5104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.110.97Google · CDNUnited States
AS15169Google LLC
5146.75.123.1Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
5152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
5142.251.110.95Google · CDNUnited States
AS15169Google LLC
535.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
5142.251.14.94Google · CDNUnited States
AS15169Google LLC
523.36.158.179Akamai · CDNFrankfurt am Main, Hesse, Germany
AS16625Akamai Technologies, Inc.
5178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
15327--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T149F3E86393E4113736A781EC5550A729FDD1F107DE2B4A88B5FC62889FE6DC63823229

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:WLxlJimAuTAUArfAGZefDPUZBRhBC5abG+hMAB/AyAfGA13PLGudZsWDSF3wjbA8:9PJ0QefDsZBRhk5sSnD3

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:162218:gDxGCOAggEgQNAjRgXcC0oERCqJroEgCBchKAAJKCDMLZQFFoEISRWhSEExAohkCFCAwVMVgIDcxhBWAAACUIugBIiLmBQQi

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000003c3c000000
Perceptual Hash:cf6c3093cf6c3093
Difference Hash:0020006868002000
Wavelet Hash:00003c3c3c3c0000
Color Hash:#d25c2d

Other Hashes

Crop Resistant:0020006868002000

Scan History

Scan history not available

Unable to load historical scan data