ScanMalware.com

Security Scan Report: redwings16.com

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Legitimate-looking clothing store whose page is compromised with a ClearFake EtherHiding loader: roster-anchored YARA hit, critical exploit-kit CnC IDS alert, and multi-feed malware threat-intel. Do not visit.

Risk Factors (5)
ClearFake/EtherHiding loader injected into page scripts
Obfuscated script resolving its next stage from a blockchain contract (EtherHiding)
CRITICAL IDS alert for exploit-kit command-and-control via admin-ajax.php
Threat-intel corroborated malware classification of the primary domain
Obfuscated JS with blockchain RPC and decoder functions
Domain age information unavailable

Details

Page Title

redwings16

Scan Type

public

Domain Name Analysis

Domain 'redwings16.com' uses the commercial generic top-level domain (.com) and has no subdomain. Its registrable label 'redwings16' stretches across 10 characters split between 2 vowels and six consonants, along with 2 digits. Segmentation suggests three words: red, wings, 16. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://redwings16.com

Page Load Overview

7.95s
Total Load Time
5.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:2,608 chars
Detector Agreement:100%

Website Classification

Primary Category

education learning57% confidence
Type: spa
Method: ml+structural

All Detected Categories

education learning
57%
documentation technical
36%
e-commerce shopping
34%
news/blog
20%

Detected Features

Articles
OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
754.36.31.145France
AS16276OVH SAS
6142.251.14.95Google · CDNUnited States
AS15169Google LLC
6142.251.13.94Google · CDNUnited States
AS15169Google LLC
6142.251.150.4Google · CDNUnited States
AS15169Google LLC
6172.217.208.95Google · CDNUnited States
AS15169Google LLC
6142.251.14.94Google · CDNUnited States
AS15169Google LLC
6142.251.155.4Google · CDNUnited States
AS15169Google LLC
6142.251.157.4Google · CDNUnited States
AS15169Google LLC
6142.251.153.4Google · CDNUnited States
AS15169Google LLC
6142.251.151.4Google · CDNUnited States
AS15169Google LLC
13923--

Detected Technologies11

WordPressv6.8.3
100%
PasswordField
100%
Open-Graph-Protocolvwebsite
100%
MetaGenerator
100%
JQueryv3.7.1
100%
YouTube
50%
PHP
50%
MySQL
50%
Blocksy
50%
WooCommerce
20%
Blocksy Companion
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FDE30971744C083A774F87CD9026339CF1CABAA6DA0295D5F2F9222893E0DF175A6739

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:biDqMoxUFk6TkTkYqkvVAzyh4Iy8TXskWbhoMqUOHCneYMTLCvrgqVsSj5IxfKfm:KqMZDYgIALTVbhoMqUEChezT

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:146088:BQJNR8IyCBClQCplQkvRkAEImLDIgpkRrZgcC4ArxCIhCGgAAQICAgQiIjhIMwFeDEhaJFCWJRpMkq2iMQKAagFU6sSCgSED

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffff0020000000ff
Perceptual Hash:e297bfb1c548083b
Difference Hash:664dc0c5c9938165
Wavelet Hash:ffff5070604000ff
Color Hash:#2d8667

Other Hashes

Crop Resistant:664dc0c5c9938165,010182d6d6020101,0dd0c5c1c1918101

Scan History

Scan history not available

Unable to load historical scan data