Security Scan Report: cilliersaviation.com

Site favicon
Submitted: Sep 23, 2026, 4:47:30 AMCompleted: Sep 23, 2026, 4:48:05 AMpubliccompleted

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Legitimate 10-year-old aviation business site appears compromised: critical EtherHiding malware IDS alert, blockchain RPC C2 fetch, and multi-source malware domain xaz2.com loaded. Avoid.

Risk Factors (5)
Critical IDS malware alert for EtherHiding exfiltration
Loads blockchain RPC gateway (tenderly.co) used for smart-contract C2 retrieval
Multi-source malware IoC on loaded resource xaz2.com
Malware IoC on the primary domain (single-source, unverified)
Inline crypto API usage consistent with injected blockchain-based loader
Domain age information unavailable

Details

Page Title

Cilliers Aviation | At the crossroads where Passion & Professionalism meet

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'cilliersaviation.com' is registered while skipping any subdomain. The second-level label 'cilliersaviation' is 16 characters long split between eight vowels and eight consonants. Splitting it apart reveals four words: cill, i, ers, aviation. Median word length is 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://cilliersaviation.com

Page Load Overview

1.86s
Total Load Time
1.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:930 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: spa
Method: structural

All Detected Categories

No categories detected

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11104.21.80.247Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.20.95Google · CDNUnited States
AS15169Google LLC
5192.190.221.135United States
AS32244Liquid Web, L.L.C
5104.16.79.73Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5172.67.155.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
535.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
5188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.110.94Google · CDNUnited States
AS15169Google LLC
468--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T118B3DA9FB7B231B47217C715FAD2733496ACC113E6121DE7BC6AA2588B82397017394E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:29i5Q62I/xE6x4g5bn/+YZdypaT/4rcTlGRNjcXscJGcz74kKTsEO1wA5a:UiC7Qyp7rAl4kqowj

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:110970:sQQQeEgAJARiQVOMADAUE1dBGY8UBYBegTaihDcDRoASwAgADSAVVRLCAhgB4AjUy2iQhwUaAEIbKPCgCAUI7IKqGAliSCKm

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffc3c3c3c3c3c3
Perceptual Hash:b9c6cc33638c3c63
Difference Hash:361e2e1e0a161606
Wavelet Hash:dfcf83838383c383
Color Hash:#78763a

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data