ScanMalware.com

Security Scan Report: phblood.com

Submitted: Sep 17, 2026, 11:47:32 PMCompleted: Sep 17, 2026, 11:48:08 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Legitimate-looking medical conference page carrying a CRITICAL EtherHiding malware alert, a blockchain RPC connection, and malware-flagged primary/third-party domains — likely compromised site serving a stealthy loader.

Risk Factors (5)
CRITICAL Suricata alert indicating EtherHiding malware exfiltration activity
Outbound connection to an Ethereum RPC endpoint (rpc.sepolia.ethpandaops.io) used for blockchain-hosted payload retrieval
Threat-intelligence report of a RAT/malware association on the primary scanned domain
External resource xaz2.com flagged as malware by two independent threat feeds
Blockchain RPC + malware IDS alert collectively indicate a stealthy loader/exfiltration chain
Domain age information unavailable

Details

Page Title

Economics of Prehospital Blood Transfusions Conference

Scan Type

public

Domain Name Analysis

The domain name 'phblood.com' uses the commercial generic top-level domain (.com). Count 7 characters in 'phblood' holding 2 vowels versus five consonants. Tokenizing the label suggests 2 words: ph, blood. Median word length is 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://phblood.com

Page Load Overview

15.17s
Total Load Time
798 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:865 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical56% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

healthcare medical
56%
government public service
38%
corporate
25%

Detected Features

OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6142.250.154.95Google · CDNUnited States
AS15169Google LLC
6188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6104.26.12.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6142.251.14.94Google · CDNUnited States
AS15169Google LLC
325--

Detected Technologies9

WordPressv6.9.4
100%
Open-Graph-Protocolvwebsite
100%
MetaGenerator
100%
PHP
50%
MySQL
50%
HTTP/3
40%
Cloudflare Bot Management
40%
Cloudflare
40%
Bricks
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18623F870909565B51A2EAF6622AFED3CC1D46525C11221F6F0EB201CE68B1F712F3DEB

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:F9i5Q62I/xE6x4g5bn/xhZdypJGmI0KNAXoc4xQZFNr:riCWByphKNAXomj

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:48756:MAloAAAQACIhYAAgBigQ7wuIdRmIoP1MUI6KJIBAARCOJAhCMsYAAQBEegB20KALwCJCgRUQKGiSWEICIQBCVtBCQA3QII9B

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00070f070707ffff
Perceptual Hash:a839d72371cc0cde
Difference Hash:3f7f7bbf3fffe908
Wavelet Hash:00070f070707ffff
Color Hash:#5f3a78

Other Hashes

Crop Resistant:3f7f7bbf3fffe908,3f1f7f7b3f7f3fff

Scan History

Scan history not available

Unable to load historical scan data