ScanMalware.com

Security Scan Report: chadoichi.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/53527baa-9c95-4a77-a7c3-c0ba2ee51feaDomain and IP registration (RDAP)/api/v1/rdap/53527baa-9c95-4a77-a7c3-c0ba2ee51feaHow often this domain was scanned/api/v1/domain/stats/chadoichi.comScan history for this domain/api/v1/domain/history/chadoichi.com?limit=15
This website contacted 5 IPs in 2 countries across 4 domains to perform 147 HTTP transactions. The main domain is chadoichi.com and was registered 1 year 4 months ago.

Submitted URL: https://chadoichi.com

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Matcha shop page is compromised: analyst-vetted IClickFix EtherHiding loader and a critical IDS malware alert mean visitors may be served a malicious second stage. Avoid interaction.

Risk Factors (5)
EtherHiding / IClickFix loader injecting a blockchain-resolved second stage into the page
Obfuscated JavaScript concealing RPC/threat-feed hosts (0xrpc.io, 1rpc.io, gateway.tenderly.co)
Critical IDS malware alert (Network Trojan) on the served traffic
Primary domain flagged as a malware stealer indicator
Site content is a German-language matcha shop, consistent with a legitimate small business whose site has been compromised and injected with the loader
Domain age information unavailable

Details

Page Title

Chadō Ichi – Best of Matcha

Scan Type

public

Domain Name Analysis

The domain name 'chadoichi.com' uses the commercial generic top-level domain (.com) and has no subdomain. The second-level label 'chadoichi' is 9 characters long split between 4 vowels and five consonants. Tokenizing the label suggests two words: chado, ichi. The median word length lands at 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://chadoichi.com

Page Load Overview

15.14s
Total Load Time
15.8 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:7,713 chars
Detector Agreement:75%

Website Classification

Primary Category

adult content58% confidence
Type: spa
Method: ml+structural

All Detected Categories

adult content
58%
blog personal website
51%
news/blog
35%
education learning
28%
government public service
27%

Detected Features

Search
Articles
OG: article

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
31193.141.3.72Germany
AS6724Strato GmbH
29104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2935.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
29172.67.133.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
29104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1475--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1B2143C73959610332B2383D1757D7488B527D16BCA828AD8F2FF409D6FE4DE71293A0A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:yYpky2lJAqKAnAs4AuqjHfAa7FZ82+aiGEvQnPHeCGJ5u7ktWZcW4ARs/HySvMee:yIQAiUa7P+aiGl

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:195326:BaBkE2BBwRUIMAqITIqeaEcEGgAhBIKBzCRIFEFRLDQkALHOJoDBlEC7VBNJKFAEEjHIDcAAgwBMSQbgooI7AGAURJkQPMOG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe00000001070ff
Perceptual Hash:c8fbf60cb9c48d42
Difference Hash:3245c1b331e3c692
Wavelet Hash:ffe930180030f2ff
Color Hash:13440010000

Other Hashes

Crop Resistant:3245c1b331e3c692,8cacbc7c7c7e777e,58c5f3b3b172e6c6

Scan History

Scan history not available

Unable to load historical scan data