ScanMalware.com

Security Scan Report: transfy.cloud

Submitted: Completed: publiccompleted

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake logistics template running a ClickFix attack: it impersonates Cloudflare and tells Windows users to paste malware into Terminal. Verify. Confirmed by YARA kit roster, 20 critical IDS alerts and a multi-source malware match on transfy.cloud.

Risk Factors (5)
Known malicious ClickFix (Win+X Terminal lure) kit injected into the page — HIGH phishing category
20 CRITICAL network IDS alerts incl. ET MALWARE EtherHiding Exfil M2
Multi-source threat-intel malware match on the primary domain (transfy.cloud)
Impersonation of Cloudflare branding and a fabricated verification flow
Unranked domain with no legitimate business identity behind the claimed logistics brand
Domain age information unavailable

Details

Page Title

Transfy – Clear the Warehouse management clutter

Scan Type

public

Domain Name Analysis

The domain 'transfy.cloud' uses the .cloud top-level domain while skipping any subdomain. The core label 'transfy' covers 7 characters split between one vowel and 6 consonants. It segments into two words: trans, fy. Expect 3.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://transfy.cloud

Page Load Overview

2.89s
Total Load Time
689 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:2,519 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: dynamic
Method: structural

All Detected Categories

No categories detected

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
16172.67.176.239Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9104.16.56.10Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9142.251.110.94Google · CDNUnited States
AS15169Google LLC
9104.21.51.69Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
915.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
934.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
9172.67.142.245Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
93.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
798--

Detected Technologies9

X-UA-Compatible
100%
WordPressv6.9.9
100%
MetaGenerator
100%
JQueryv3.7.1
100%
Cloudflare Bot Management
55%
PHP
50%
MySQL
50%
HTTP/3
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T175E3D58F97BA31B571074789F9D6733496ADC133D55209E2F8B6C58C8FC226302A672E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:YKypQMD/GMv2Y35821suNGrsQ4kZwLmfjYuypY1DmYJH6kcpGTFXejqdv:IQ4kZwLm7YHSD9JaklTFOj+v

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:151006:JSGIkBhgV8IGYC0ROgSBwFFBCyCQIAYEotArgBWAUIMBhAAggZGgI6MaAgBQMAwkpadAABQgAUlAckURIK6MTcCaBnQoIoer

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff01313120061e18
Perceptual Hash:8ae99db1c894f6c8
Difference Hash:7b73e5e1c9cc6861
Wavelet Hash:ff013131312f3f38
Color Hash:#7f79d2

Other Hashes

Crop Resistant:7b73e5e1c9cc6861,f2f6e7e7e3e3e6cc,9282828282828282,4040404040400000,73f3e5e3c9cc6861

Scan History

Scan history not available

Unable to load historical scan data