Security Scan Report: www.gusanacoating.com

Site favicon
Submitted: Oct 1, 2026, 1:04:40 PMCompleted: Oct 1, 2026, 1:05:28 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 90%

9
Risk Score

Legitimate Indonesian paint site (gusanacoating.com) has been compromised: it injects casino SEO spam, loads ClearFake/EtherHiding malware via blockchain RPC nodes, and shows a fake CAPTCHA/ClickFix lurer. Do not interact.

Risk Factors (5)
ClearFake exploit-kit / EtherHiding malware loader hosted in compromised WordPress site
Critical network IDS alerts for blockchain-based exfiltration (EtherHiding)
Hidden casino/gambling SEO-spam links injected into legitimate paint-company content, unrelated to the site's business
Fake Cloudflare-style browser verification page that instructs users to paste commands into Windows Terminal (ClickFix)
Page scripts make XMLHttpRequest calls to multiple unranked blockchain RPC nodes used for payload/C2 retrieval
Domain age information unavailable

Details

Page Title

Gusana Coating – Gusana Paint

Scan Type

public

Domain Name Analysis

The domain 'www.gusanacoating.com' uses the commercial generic top-level domain (.com) and includes subdomain 'www'. Count 13 characters in 'gusanacoating' with six vowels and 7 consonants. Segmentation suggests four words: gus, an, a, coating. The median word length lands at 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://www.gusanacoating.com/

Page Load Overview

8.13s
Total Load Time
2.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:3,473 chars
Detector Agreement:50%

Website Classification

Primary Category

gambling betting71% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

gambling betting
71%
entertainment media
31%
news/blog
20%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
5103.147.154.189Jakarta, Jakarta, Indonesia
AS138115PT Deneva
574.125.29.95Google · CDNUnited States
AS15169Google LLC
5192.178.183.94Google · CDNUnited States
AS15169Google LLC
5104.26.2.238Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5172.67.68.134Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5104.18.11.59Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
459--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T186D31B7197A0157E267B43BCF55AFB0855698513DA0DA3DAF1BEC0D892C9FA300B270E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:/PInAlnZtS+SHBHfiJiCCFypGdRTz1Rq7T6Iv840gyWRRyu:nyqN3oWRgu

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:133695:ABBhgAgQT2FYoNUB2qyABKLIMSttKGgE4EyiQCcgoAcJmAGeggiQEAEiDGJsBlhBBUKBBBA1CAAgwggRIp+SsGDpQCxJASlG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000f0f0f000ffff
Perceptual Hash:c060bf1fc53978c6
Difference Hash:81e5a5a5a5a55900
Wavelet Hash:0020f0f0f070ffff
Color Hash:#2d8649

Scan History

Scan history not available

Unable to load historical scan data