ScanMalware.com

Security Scan Report: theparknonthaburi.com

Site favicon
Submitted: Sep 15, 2026, 9:47:28 AMCompleted: Sep 15, 2026, 9:47:57 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 88%

9
Risk Score

Likely compromised restaurant site now serving a fake-CAPTCHA ClickFix prompt and blockchain (EtherHiding) C2/exfiltration — 17 CRITICAL malware IDS alerts and a primary-domain malware indicator. Do not paste or run anything.

Risk Factors
CRITICAL IDS ET MALWARE EtherHiding exfiltration alerts (x17)
Fake reCAPTCHA verification that pushes Windows PowerShell one-line paste (ClickFix malware delivery)
Connections to blockchain RPC / smart contract C2 infrastructure
Primary domain matched a malware 'unknown loader' threat-intel indicator
Obfuscated inline JavaScript with eval() and decode/encode routines on a restaurant site that has no reason to use them
Domain age information unavailable

Details

Page Title

theparknonthaburi |

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'theparknonthaburi.com' is registered while skipping any subdomain. The second-level label 'theparknonthaburi' is 17 characters long holding 6 vowels versus eleven consonants. It segments into 3 words: the, park, nonthaburi. Average segment length settles at 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://theparknonthaburi.com

Page Load Overview

8.15s
Total Load Time
7.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:2,902 chars
Detector Agreement:67%

Website Classification

Primary Category

phishing scam30% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

phishing scam
30%
real estate property
28%
entertainment media
26%
travel tourism
26%
adult content
25%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
15122.155.18.144Thailand
AS9335National Telecom Public Company Limited
415.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
43.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
4142.250.154.95Google · CDNUnited States
AS15169Google LLC
4172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.18.11.59Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
434.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
43.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
4104.18.10.59Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6714--

Detected Technologies6

X-UA-Compatible
100%
WordPressv7.1
100%
MetaGenerator
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A054D70EAF7531B132674341FDCE3B68853CC623A59244CBB69DD5094BC07AA11BB6AF

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:PpMwRrdczEYu7E5cue7RIvZ9synAWtAvMh/czYPkktn++PfxF9I1RmO2H:hGu7EKi9synttJEzYP5++RF9N

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:299933:giAhQAslAAPcTJWFKSzK9GkAYEGpYjoWmASyRaoA8Ro95MCgmUqISJQIEIgliCSIJArgAmZQgQ3RQIASSgAEuBEiAkNYtOjR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:81adadbd8581bfff
Perceptual Hash:bb7ae039f03125a5
Difference Hash:1949697975755923
Wavelet Hash:818d858d8181bfff
Color Hash:#ac5388

Other Hashes

Crop Resistant:1949697975755923,450b2b0b0b111199,0401634010d25150,696c64e6fa6a65d3

Scan History

Scan history not available

Unable to load historical scan data