Security Scan Report: btltrimsaccessories.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 19 IPs in 3 countries across 15 domains to perform 222 HTTP transactions. The main domain is btltrimsaccessories.com and was registered 4 months ago.

Submitted URL: https://btltrimsaccessories.com

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Compromised textile-business site carrying an injected ClickFix/EtherHiding blockchain loader: analyst-vetted kit roster hit and 8 CRITICAL IDS malware alerts. Do not visit; the overlay may trick Windows users into running a malicious command.

Risk Factors (5)
Injected ClickFix / EtherHiding blockchain loader on a compromised page (analyst-vetted kit roster, CRITICAL)
8 CRITICAL IDS alerts for EtherHiding C2 exfiltration and a known ClickFix domain (gateway.tenderly.co)
Obfuscated script resolving a payload address from a Polygon smart contract
Unranked script host browse-codes-enter.beer serving code to the page
Multiple cross-origin blockchain RPC endpoints contacted via XMLHttpRequest
Domain age information unavailable

Details

Page Title

Home Accessories - BTL Trims & Accessories

Scan Type

public

Domain Name Analysis

Domain 'btltrimsaccessories.com' uses the commercial generic top-level domain (.com) with no subdomain. The registrable portion 'btltrimsaccessories' spans 19 characters with six vowels and 13 consonants. Tokenizing the label suggests 4 words: b, tl, trims, accessories. Expect 3.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://btltrimsaccessories.com

Page Load Overview

11.02s
Total Load Time
6.3 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:3,885 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical59% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
59%
corporate business
47%
adult content
45%
social_media
35%
forum
35%

Detected Features

Login Form
Articles
Comments
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
24209.74.68.17Singapore
AS22612Namecheap, Inc.
11104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
11152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
1135.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
11178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
11142.251.14.95Google · CDNUnited States
AS15169Google LLC
11142.251.14.97Google · CDNUnited States
AS15169Google LLC
11192.0.73.2San Francisco, California, United States
AS2635Automattic, Inc
11142.251.127.84Google · CDNUnited States
AS15169Google LLC
11172.67.130.228Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
22219--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1688409A3650D1C6D0B2B57E6C085BD78B85B9977EE8DD6E0F7F2682C3780A853301939

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:AADXzKaEGsK2+Q1HrK9O5PFXGYfLPwzuuwFQik26tHmX5vNp1:fzK3+Q1Ho6Qik2smX5vNp1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:375810:ZAEAJ4EQAmpKQFJBUEHEgAUaJZgAccLDESgmAgYzUUCqQggY0AnJIKsMQURvIvJwCATLoinSjMgCgA4joQTUnICkyiGijAUD

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff01000000000001
Perceptual Hash:aad4add4a9d4a9d0
Difference Hash:638901010101010b
Wavelet Hash:fffff1f101010103
Color Hash:#bbe06c

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data