Security Scan Report: logistica.business

Site favicon
Submitted: Oct 4, 2026, 4:25:04 AMCompleted: Oct 4, 2026, 4:26:16 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Compromised WordPress site injecting an analyst-vetted ClickFix kit: a fake Cloudflare verification overlay that lures Windows users into pasting PowerShell into Terminal. CRITICAL YARA and IDS hits confirm malware delivery.

Risk Factors (6)
ClickFix terminal-paste malware delivery kit injected into page (roster-anchored, CRITICAL)
HIGH-PRECISION YARA rule ClickFix_WinX_Overlay_Kit matched on page HTML
Fake 'Human Verification' overlay impersonating Cloudflare verification and displaying a Ray ID
CRITICAL IDS alerts for ClickFix C2 domain zvh4.com (TLS SNI and DNS) and EtherHiding exfiltration
Threat-intel labels primary domain as a malware loader and lists multiple flagged third-party resource domains
WordPress site repurposed for gambling SEO spam unrelated to its stated mining/logistics content
Domain age information unavailable

Details

Page Title

Logistica

Scan Type

public

Domain Name Analysis

The domain 'logistica.business' uses the .business top-level domain. Count 9 characters in 'logistica' split between four vowels and 5 consonants. It segments into two words: logistic, a. Median word length is 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://logistica.business/

Page Load Overview

32.45s
Total Load Time
3.8 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:14,961 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical51% confidence
Type: spa
Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical
51%
technology software
31%

Detected Features

Search
Comments

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1194.136.170.157United Kingdom
AS42831UK Dedicated Servers Limited
6172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
6104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6104.21.38.103Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6192.0.77.48San Francisco, California, United States
AS2635Automattic, Inc
6104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8313--

Detected Technologies7

WordPressv7.0.2
100%
JQueryv3.7.1
100%
Bootstrapv7.0.2
100%
50%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D2441962931808FE345F8B98E448B71DF149EA02DE0646DAF9F5C255A4CDDF628B370E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:yRRdHZobiemlUVugamPopJbE7TzpcMrEhJ:0Rd/

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:258506:iAUBjHsCIkAENgFcFABeFgAdJCl0AwnCEIAIAQCg2gKoTDACToYmSaMgi9sAIAHOneUAgiWC6xALAiD1BEyASG4A3CACoBwA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:020200000000ffff
Perceptual Hash:9514c53e54eb3ce4
Difference Hash:f6fe9a98ae7b6546
Wavelet Hash:060f0f0c008bffff
Color Hash:#2d8649

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data