Security Scan Report: northhillsingers.com

Site favicon
Submitted: Sep 30, 2026, 1:47:27 AMCompleted: Sep 30, 2026, 1:48:02 AMpubliccompleted

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Legitimate self-branded powwow-group site, but a CRITICAL EtherHiding malware IDS alert, a blockchain RPC connection, and multi-source malware threat-intel on a loaded third-party domain indicate the site is compromised to distribute malware.

Risk Factors (4)
CRITICAL Suricata IDS alert for EtherHiding malware exfiltration
Blockchain RPC connection associated with EtherHiding (blockchain-based malware C2/payload delivery)
Multi-source malware threat-intel match on third-party domain zvh4.com loaded by the page
Primary domain flagged as RAT malware (single-source, unverified)
Domain age information unavailable

Details

Page Title

North Hill Singers – Northern Contemporary Youth Powwow Drum Group

Scan Type

public

Domain Name Analysis

Domain 'northhillsingers.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. The core label 'northhillsingers' covers 16 characters holding four vowels versus 12 consonants. Word splitting yields three words: north, hill, singers. Expect five characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://northhillsingers.com

Page Load Overview

3.11s
Total Load Time
288 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:1,723 chars
Detector Agreement:100%

Website Classification

Primary Category

education learning63% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

education learning
63%
government public service
28%

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4162.210.102.130United States
AS14555LiquidNet US LLC
3104.26.12.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
103--

Detected Technologies4

WordPressv7.0.2
100%
50%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T114336E72909814BB3A2F87A9F1A4F714B2569734CF021B66F3FD214847C5EBA0477A1E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:Hc0zDBR+V+r7VH9rQVTtifL/7WiZdyp6QCMCOV2cBqY2KliKN5tRuuAPByxYVqeR:TF7d9Jj5ypRlLnuuyyxYVqe/1nz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:53056:YBlQbSY2QEgCspZhEGBAJCd4iMzRQcABgaAYLgAkYhLhQmBaWLGgoAV7CkQAIQoKaLAjiJgIEOIiqNJMWAKRDGBewyAQgQBO

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:009f9fffffffff00
Perceptual Hash:bc9c1e9e63e143c1
Difference Hash:3020281234200031
Wavelet Hash:009e9ec39f9f9f00
Color Hash:#3a7853

Scan History

Scan history not available

Unable to load historical scan data