ScanMalware.com

Security Scan Report: atwcolombia.com

Submitted: Oct 11, 2026, 11:39:09 PMCompleted: Oct 11, 2026, 11:40:05 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Compromised site serving the ClearFake EtherHiding/ClickFix kit: two analyst-vetted YARA hits plus a two-feed clearfake malware threat-intel match. Confirmed malicious — do not visit.

Risk Factors (5)
ClearFake malware kit injected into the page (blockchain/EtherHiding contract loader + rival-kit cleanup overlay)
Two high-precision YARA rules for the ClearFake family matching the page HTML
Primary domain flagged as clearfake malware by two independent threat-intelligence feeds
Multiple Suricata obfuscated-JavaScript hunting alerts
Russian-language SEO spam promoting 1win app downloads and a casino brand on an unrelated 'ATW Internacional' site
Domain age information unavailable

Details

Page Title

ATW Internacional -

Scan Type

public

Domain Name Analysis

You're looking at domain 'atwcolombia.com' on the commercial generic top-level domain (.com) with no subdomain. The core label 'atwcolombia' covers 11 characters split between five vowels and six consonants. Splitting it apart reveals 3 words: at, w, colombia. Median word length is 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://atwcolombia.com

Page Load Overview

4.45s
Total Load Time
1.9 MB
Total Size

Language Analysis

Primary Language

🇷🇺Russian
Code: ru
Confidence:79%
Script:Cyrillic
Direction:ltr

Detection Details

HTML Lang Attribute:es
Text Length:14,794 chars
Detector Agreement:100%
Language mismatch: Declared as es but detected as ru

Website Classification

Primary Category

technology software62% confidence
Type: spa
Method: ml+structural

All Detected Categories

technology software
62%
download file sharing
56%
government public service
51%
documentation technical
44%
cryptocurrency blockchain
44%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
19104.218.8.119United States
AS55293A2 Hosting, Inc.
18142.251.13.95Google · CDNUnited States
AS15169Google LLC
18192.178.183.97Google · CDNUnited States
AS15169Google LLC
18142.251.13.94Google · CDNUnited States
AS15169Google LLC
18216.239.34.36Google · CDNUnited States
AS15169Google LLC
18216.239.32.36Google · CDNUnited States
AS15169Google LLC
1096--

Detected Technologies17

X-UA-Compatible
100%
WordPressv7.0
100%
Open-Graph-Protocolvwebsite
100%
Modernizrvcustom.min
100%
MetaGenerator
100%
JQueryv3.7.1
100%
Google-AnalyticsvUniversal
100%
PHP
50%
MySQL
50%
Litespeed Cache
40%
LiteSpeed
40%
HTTP/3
40%
HSTS
40%
Google Analytics
35%
WooCommerce
20%
Phlox
20%
Joinchat
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1E4F32AA1BDFB086A2107516ED8157A0D79BAC5BBEB4AC16479BC773D1FF1DE0422220C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:YZNVAR97P0ZgAhGAMA/qAB819Fj751OtdSIVl1B7Kc1EPVnC6fAdXDBwWeNXv7QS:xR9ApR3AcS6l3Wc1wVnCteV

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:170285:BwA6C0mnSPQMwA4VDAQhAFRAIhSYEColIAUOAGQWEgihkIIUmopSQCEIkQSAOAA/2RNHBEQWQg8BdJReTpHIGYAUNEgJQgCo

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffff8f078f9f9f
Perceptual Hash:bf62582b357a1946
Difference Hash:8b00597e565e7e70
Wavelet Hash:00ffff03030f871e
Color Hash:#77862d

Other Hashes

Crop Resistant:8b00597e565e7e70,0141939383438001

Scan History

Scan history not available

Unable to load historical scan data