Security Scan Report: airconditioncapetown.co.za

Site favicon
Submitted: Completed: publiccompleted
This website contacted 8 IPs in 2 countries across 8 domains to perform 86 HTTP transactions. The main domain is airconditioncapetown.co.za and was registered 3 years 6 months ago.

Submitted URL: https://airconditioncapetown.co.za

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Legitimate Cape Town HVAC site that has been compromised: an injected ClickFix/EtherHiding kit loads a fake 'Human Verification' overlay and pulls its payload host from a blockchain contract via cloud-browse.codes. Do not visit.

Risk Factors (5)
Known ClickFix/EtherHiding malware kit injected into a legitimate business website
Obfuscated script contacts blockchain RPC endpoints to resolve a rotating payload host
Obfuscated script hides multiple threat-feed-listed hosts (cloud-browse.codes, 1rpc.io, polygon.drpc.org, quiknode.pro)
CRITICAL IDS alert for EtherHiding exfiltration traffic during page load
Primary domain flagged for iclickfix malware distribution (single-source, unverified)
Domain age information unavailable

Details

Page Title

Air Conditioning Installations Specialists – Sales, Repairs, Services, Regas

Scan Type

public

Domain Name Analysis

You're looking at domain 'airconditioncapetown.co.za' on the South African country-code top-level domain (.co.za) without a subdomain. The core label 'airconditioncapetown' covers 20 characters containing nine vowels alongside eleven consonants. Tokenizing the label suggests 3 words: air, condition, capetown. Median word length is 8 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://airconditioncapetown.co.za

Page Load Overview

4.13s
Total Load Time
1.4 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:8,619 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical44% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
44%
blog personal website
42%
real estate property
27%

Detected Features

Products

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
16162.241.24.56Phoenix, Arizona, United States
AS31898Oracle Corporation
10104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10192.178.183.95Google · CDNUnited States
AS15169Google LLC
10178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
10192.0.77.2San Francisco, California, United States
AS2635Automattic, Inc
10192.0.76.3San Francisco, California, United States
AS2635Automattic, Inc
10142.251.110.94Google · CDNUnited States
AS15169Google LLC
10172.66.146.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
868--

Detected Technologies17

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F334F96BF2D510AB712B89A9429A333CF938D043CB065998B0FDA3768FCEDD5655360C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:Ia5MqPwFkw7athsob93RyrtuMGA6MX9+cjm6PJGUYIQA/cF3sa9Aap3/ke:8ke+9Y/E/ke

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:247832:MIkRLACyBn6NrVAYQkbFEIIBYEACMBGCC4DmijCh0gQ8MCggkAjGEEmGKiARAk8BACjoARjASDMAIEiYZA1smkMhIAaMiiEH

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7c3c3fffffff7
Perceptual Hash:b03023c7cecccdcd
Difference Hash:0c1c163600000008
Wavelet Hash:fcc0c0c0fcfcff00
Color Hash:#b7bf40

Other Hashes

Crop Resistant:0c1c163600000008

Scan History

Scan history not available

Unable to load historical scan data