Security Scan Report: hmsbd.top

Submitted: Completed: publiccompleted
This website contacted 12 IPs in 1 country across 11 domains to perform 45 HTTP transactions. The main domain is hmsbd.top and was registered 7 months ago.

Submitted URL: https://hmsbd.top

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Confirmed ClickFix attack: the page impersonates a Cloudflare bot check and instructs Windows users to paste a PowerShell command (Win+X), backed by a malware IoC on hmsbd.top and 19 critical EtherHiding exfiltration IDS alerts.

Risk Factors (5)
Known ClickFix/Win+X social-engineering kit delivering a clipboard-paste PowerShell command
Multi-source threat-intelligence match on the scanned primary domain (clearfake malware)
Nineteen critical ET MALWARE EtherHiding Exfil alerts indicating hidden blockchain-based C2/exfiltration
Fake Cloudflare verification overlay impersonating a security vendor
Obfuscated intent: the page masks a malicious directory index as a bot-check interstitial
Domain age information unavailable

Details

Page Title

Index of /

Scan Type

public

Domain Name Analysis

You're looking at domain 'hmsbd.top' on the .top top-level domain and has no subdomain. The second-level label 'hmsbd' is 5 characters long holding 0 vowels versus five consonants. Splitting it apart reveals 2 words: hms, bd. Average segment length settles at 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://hmsbd.top

Page Load Overview

1.55s
Total Load Time
367 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:57%
Script:Latin
Direction:ltr

Detection Details

Text Length:999 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software77% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
77%
documentation technical
55%
government public service
33%
phishing scam
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
12172.67.187.223Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.21.64.211Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
33.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
33.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
315.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
335.71.129.99Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
3142.215.53.55Washington, District of Columbia, United States
AS15830Equinix (EMEA) Acquisition Enterprises B.V.
3172.66.146.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
334.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
4512--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T10A71B6B7B4D6D017133336FA6095730CE043E95CCA8D9DB8B4B90A41A761EFA9017ED8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:Aq444M4UEkc6/wMETUSS3Sp1dO2XLryNw:Ax4r4UEkz/6Ifw

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:3764:ADBAABAcEABABQAgACgSIAAUhgABAIQGEIAABBA0ADIQAQBQQwaYEABiAKAABwIBMJigAEAIoABBgAIBoAAAAAIACAB4BBQB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:9c3c000000000000
Perceptual Hash:9e9e9e9e0c2c2939
Difference Hash:2828120000000000
Wavelet Hash:1e7e00000f0f0f0f
Color Hash:#6a2d86

Other Hashes

Crop Resistant:2828120000000000

Scan History

Scan history not available

Unable to load historical scan data