Security Scan Report: theplumberinc.com

Submitted: Completed: publiccompleted
This website contacted 16 IPs in 2 countries across 9 domains to perform 71 HTTP transactions. The main domain is theplumberinc.com and was registered 11 years ago.

Submitted URL: https://theplumberinc.com

AI Security Verdict

High Risk

Confidence: 90%

9
Risk Score

Legitimate Phoenix plumbing business whose site is compromised with an IClickFix/EtherHiding loader: obfuscated script pulls a second stage from a Sepolia smart contract and contacts flagged host zvh4.com, confirmed by 3 critical IDS alerts. Do not interact; malware risk.

Risk Factors (4)
Compromised legitimate plumbing site actively injecting a ClickFix/EtherHiding malware loader
Decoded obfuscated JavaScript communicates with blockchain RPC and known-malicious hosts
Critical IDS malware signatures on live traffic to/from the page
Primary domain reported as 'unknown stealer' in a single-source threat-intel submission (unverified)
Domain age information unavailable

Details

Page Title

Phoenix Plumbers | Emergency Plumbing 24 Hour Rooter Service

Scan Type

public

Domain Name Analysis

The domain 'theplumberinc.com' uses the commercial generic top-level domain (.com) without a subdomain. Its registrable label 'theplumberinc' stretches across 13 characters containing 4 vowels alongside 9 consonants. Breaking it apart gives 3 words: the, plumber, inc. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Call Today: (602) 497-1480 Th e P l um be r | nc. Home About y Plumbing Services Phoenix y Water Treatment Systems Blog Contact Schedule Online Valley Plumbing Professionals 100% Satisfaction Guaran...

Page Load Overview

0.59s
Total Load Time
3.3 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:5,793 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate70% confidence
Type: spa
Method: structural

All Detected Categories

corporate
70%

Detected Features

Search
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11194.1.147.89Manchester, England, United Kingdom
AS210250K Media Tech Ltd.
4104.16.179.112Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.127.95Google · CDNUnited States
AS15169Google LLC
4142.251.153.119Google · CDNUnited States
AS15169Google LLC
4172.217.116.4Google · CDNUnited States
AS15169Google LLC
4142.251.14.94Google · CDNUnited States
AS15169Google LLC
4194.1.147.97Manchester, England, United Kingdom
AS210250K Media Tech Ltd.
4104.16.180.112Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.154.119Google · CDNUnited States
AS15169Google LLC
4172.217.113.4Google · CDNUnited States
AS15169Google LLC
7116--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T186A32AF24F1D40B5227B6685FEBAF25492B68357CB03848DB3FC527897D2E8751E2209

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:GG9YVgqgL+WR3hfAIbPVpc7yg10S6bKgUW:hhigUW

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:103409:SGhtRGtyBgQzAeF1kYcAEWgDYoDXQC4sGkiJEIEAQM0gAgYgABqIAC1IzSUSAioLyASIYaFRCDHR+IhD5Aw4RAKi6goPASLQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ff9f0f0f0f93ff
Perceptual Hash:bd42e61f611c176c
Difference Hash:c424345c1c343626
Wavelet Hash:00bf9f0f060f83f3
Color Hash:07e00010000

Scan History

Scan history not available

Unable to load historical scan data