Security Scan Report: rafamecanicamultimarcas.com.br

Site favicon
Submitted: Completed: publiccompleted
This website contacted 27 IPs in 2 countries across 8 domains to perform 140 HTTP transactions. The main domain is rafamecanicamultimarcas.com.br and was registered 3 years 4 months ago.

Submitted URL: https://rafamecanicamultimarcas.com.br

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Legitimate-looking auto repair shop whose obfuscated scripts use EtherHiding/blockchain RPC for a hidden next stage, and whose domain is flagged as a malware loader — likely a compromised site; avoid.

Risk Factors (3)
Obfuscated JavaScript with hidden blockchain RPC endpoints and EtherHiding next-stage resolution — indicative of a compromised site used as a malware loader
Single-source threat-intelligence match flagging the primary domain as a malware loader
Blockchain RPC connections embedded in an unrelated small-business website
Domain age information unavailable

Details

Page Title

Rafa Mecânica – Multimarcas

Scan Type

public

Domain Name Analysis

The domain name 'rafamecanicamultimarcas.com.br' uses the Brazilian country-code top-level domain (.com.br) and has no subdomain. The second-level label 'rafamecanicamultimarcas' is 23 characters long holding 10 vowels versus 13 consonants. It segments into seven words: ra, fame, can, ica, multi, marc, as. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

= 1 rd as mm SobreNós Serviços Contato Onde Estamos — fem; [MECÂNICA MULTIMARCAS J Revisao Preventiva Solicite seu orçamento Contato QUALIDADE COMPROMETIMENTO AGILIDADE SEGURANÇA Rafa Mecânica R...

Page Load Overview

9.85s
Total Load Time
10.6 MB
Total Size

Language Analysis

Primary Language

🇵🇹Portuguese
Code: pt
Confidence:37%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:1,856 chars
Detector Agreement:50%
Language mismatch: Declared as en-US but detected as pt

Website Classification

Primary Category

documentation technical78% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
78%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10187.1.136.230Porto Alegre, Rio Grande do Sul, Brazil
AS28299LWSA S/A
5142.251.14.95Google · CDNUnited States
AS15169Google LLC
535.71.129.99Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
53.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
5104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
53.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
515.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
5142.215.53.55Washington, District of Columbia, United States
AS15830Equinix (EMEA) Acquisition Enterprises B.V.
5142.250.154.94Google · CDNUnited States
AS15169Google LLC
14027--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T133342B317D4B2836211F119F6047364CE0C6CBE5D953A6F1F1FA4128A6F9EE037A369A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:HZJEeQQrIs26FkJF6lgsl8uz1uAsl809v:HXQQwIkue

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:244464:TkQoIBUzgEA4KYkqFAIElSYFaalzxAE4awvSHjSk6ESSCIKKAAhACmVkgjIAzkQJQr0IkCUEBDmIUlAgZoKBWFLQVTiEKCDN

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff00000000c3ffff
Perceptual Hash:ec149cbc869bb8d2
Difference Hash:3236914dcc370a23
Wavelet Hash:ff90408000c3ffff
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data