ScanMalware.com

Security Scan Report: signsexpressmedia.com

Site favicon
Submitted: Sep 17, 2026, 7:47:29 AMCompleted: Sep 17, 2026, 7:48:38 AMpubliccompleted

AI Security Verdict

High Risk

Confidence: 78%

8
Risk Score

Legitimate-looking 7-year-old signage site whose domain is threat-intel flagged as RAT malware and which loads a corroborated ClickFix resource, with a CRITICAL EtherHiding malware IDS alert and Ethereum RPC lookups. Likely compromised — avoid.

Risk Factors
Indicators of Compromise match on the primary domain naming RAT malware (single-source, unverified)
Corroborated malware-tagged third-party resource (xaz2.com, ClickFix) loaded by the page
CRITICAL network IDS alert for malware (EtherHiding exfiltration)
DNS/TLS communication with an Ethereum RPC endpoint (0xrpc.io) indicative of EtherHiding activity
Domain age information unavailable

Details

Page Title

Home – Signs Express

Scan Type

public

Domain Name Analysis

The domain 'signsexpressmedia.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. The core label 'signsexpressmedia' covers 17 characters containing six vowels alongside eleven consonants. Tokenizing the label suggests three words: signs, express, media. Median word length is 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://signsexpressmedia.com

Page Load Overview

18.92s
Total Load Time
5.4 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:8,096 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate business42% confidence
Type: spa
Method: ml+structural

All Detected Categories

corporate business
42%
corporate
35%
government public service
32%
news/blog
20%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7162.210.96.128United States
AS14555LiquidNet US LLC
5142.251.20.95Google · CDNUnited States
AS15169Google LLC
5104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.250.154.95Google · CDNUnited States
AS15169Google LLC
5104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5146.19.24.104Poland
AS201814MEVSPACE sp. z o.o.
5188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.110.94Google · CDNUnited States
AS15169Google LLC
5157.240.0.6Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
5142.251.13.97Google · CDNUnited States
AS15169Google LLC
14228--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F5F20B33D15401563F1ED7DDB2F2726CD148A91ACA16A7ABF0AD21BC46A85F70063E2B

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:Kr9i5Q62I/xE6x4g5bn/AcCBSW8Zdyp6pfbAQkuNHiSIFT:KJiCKnypsfbAQkuNHiSIFT

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:34491:Uge4EQmIXDAAFhJBMGAFwBkPGAKChD4+UYJAQogAAwTm1CAqGJEAGhkooHUzYQInICFQQxxgCYWENCkQEJlRAigkiiLABoAl

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:000000ffffffffff
Perceptual Hash:c44044c3b7bb3b3b
Difference Hash:c4e4a50000000c4c
Wavelet Hash:000000ffffffff00
Color Hash:#ac53a2

Other Hashes

Crop Resistant:c4e4a50000000c4c,e4c4c4e4e4a4c3e1

Scan History

Scan history not available

Unable to load historical scan data