Security Scan Report: homefreequote.us

Submitted: Completed: publiccompleted
This website contacted 29 IPs in 2 countries across 22 domains to perform 198 HTTP transactions. The main domain is homefreequote.us and was registered 5 years ago.

Submitted URL: https://homefreequote.us

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Insurance-quote front page hosts an EtherHiding malware loader: primary domain flagged as malware by two feeds, 20 critical IDS exfil alerts, BSC RPC C2 traffic, and a fake-CAPTCHA that tells users to paste PowerShell commands.

Risk Factors (5)
Content-malware Indicators of Compromise on the primary domain, corroborated by two independent feeds
20 CRITICAL IDS malware alerts indicating EtherHiding exfiltration
Blockchain RPC connections used as a malware command-and-control channel
ClickFix-style social engineering pushing users to execute PowerShell commands
Obfuscated/dynamic JavaScript (eval) without a documented purpose
Domain age information unavailable

Details

Page Title

Home - Homefreequote.us

Scan Type

public

Domain Name Analysis

You're looking at domain 'homefreequote.us' on the United States country-code top-level domain (.us) with no subdomain. Count 13 characters in 'homefreequote' with seven vowels and six consonants. Segmentation suggests three words: home, free, quote. Median word length is 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://homefreequote.us

Page Load Overview

5.77s
Total Load Time
3.6 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:4,156 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical64% confidence
Type: spa
Method: ml+structural

All Detected Categories

healthcare medical
64%
government public service
47%
corporate
35%
news/blog
20%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
30184.168.100.46Singapore, Singapore
AS26496GoDaddy.com, LLC
6142.251.13.95Google · CDNUnited States
AS15169Google LLC
6192.0.77.37San Francisco, California, United States
AS2635Automattic, Inc
6142.251.20.97Google · CDNUnited States
AS15169Google LLC
6192.178.183.156Google · CDNUnited States
AS15169Google LLC
6192.0.77.2San Francisco, California, United States
AS2635Automattic, Inc
6192.0.76.3San Francisco, California, United States
AS2635Automattic, Inc
6104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
615.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
63.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
19829--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19A748F72BB402439212B03AEB157B60CA0D5A742DA0D97F4F4FE5128C6DAFE2357365E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:tLmFG06KOH/G1jp/qZPuaLbRg0DrEuiBKe9xyPTYa49fEh:8E06KOH/4jeh

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:351184:CAoQYZFgkBAzCgEASRKLtwYEJCAzCCJE0AIchVMEARGgcFEQ8oUKVwLjQMoOIMda1GcokRAFBhAUAMIDyMAhhhQQAJMEFisB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fd01010100ffffff
Perceptual Hash:ab1bb4c64bb5c078
Difference Hash:233b3b3b33c50c0e
Wavelet Hash:fd00000008ffffff
Color Hash:#ac6953

Other Hashes

Crop Resistant:233b3b3b33c50c0e

Scan History

Scan history not available

Unable to load historical scan data