Security Scan Report: temdetudoecommerce.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 8 IPs in 3 countries across 6 domains to perform 154 HTTP transactions. The main domain is temdetudoecommerce.com and was registered 1 year 9 months ago.

Submitted URL: https://temdetudoecommerce.com/

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Legitimate Brazilian candy e-commerce store that has been compromised: an injected ClickFix overlay and EtherHiding blockchain loader push Windows users to run Terminal commands. Multi-feed threat intelligence and critical IDS malware alerts confirm. Do not enter data; avoid.

Risk Factors (5)
Compromised WordPress/WooCommerce store serving a ClickFix social-engineering overlay that instructs Windows users to open Terminal and paste commands
EtherHiding / blockchain-contract-hosted payload loader in obfuscated JavaScript
Multi-source threat-intelligence match on the primary domain and on the scanned URL
Critical EtherHiding exfiltration IDS alerts and inbound Spamhaus DROP-listed traffic
Third-party obfuscated script served from unranked host cloud-browse.codes
Domain age information unavailable

Details

Page Title

TDT e-commerceother network

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'temdetudoecommerce.com' is registered and has no subdomain. Count 18 characters in 'temdetudoecommerce' split between 8 vowels and ten consonants. Tokenizing the label suggests five words: tem, de, tudo, e, commerce. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://temdetudoecommerce.com/

Page Load Overview

7.06s
Total Load Time
6.2 MB
Total Size

Language Analysis

Primary Language

🇵🇹Portuguese
Code: pt
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:pt-BR
Text Length:9,413 chars
Detector Agreement:100%

Website Classification

Primary Category

e-commerce shopping61% confidence
Type: spa
Method: ml+structural

All Detected Categories

e-commerce shopping
61%
news/blog
20%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
21162.241.2.93Vinhedo, São Paulo, Brazil
AS31898Oracle Corporation
1974.125.29.95Google · CDNUnited States
AS15169Google LLC
19104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
19142.251.14.94Google · CDNUnited States
AS15169Google LLC
19172.66.146.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
19178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
19142.251.110.95Google · CDNUnited States
AS15169Google LLC
19172.67.70.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1548--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1018419B3EAB8183A526F62D41024379DFC5D9016E68245D4F2F636BED7C9DE3222760C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:/kbMrRtCfrAeJAfAgmAUhR+jrlAXAZYMmUA/Ae7vZ7qUvnDimIg3GDh3HpwK/VJZ:hjoqgwKIerZ7NvHIfP3se/mb2

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:398670:gRQJYmAImOSQDSA1RgFCOEsgQGJAggEVBjYoQKwKGAd0gaUEDAspnwACxZBYLtoAAFqgpAgIAgMYEsBAEHFJKRBgaEKCjTCW

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7c7c3ffffffff
Perceptual Hash:b03066c7ce8ccdcd
Difference Hash:0c1c141e00000008
Wavelet Hash:fcc0c0c0fcfcff00
Color Hash:#40acbf

Other Hashes

Crop Resistant:0c1c141e00000008

Scan History

Scan history not available

Unable to load historical scan data