Security Scan Report: popstarperformers.co.uk

Site favicon
Submitted: Sep 17, 2026, 10:47:48 AMCompleted: Sep 17, 2026, 10:48:32 AMpubliccompleted

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Legitimate children's performing arts site appears compromised: critical IDS EtherHiding malware alert, blockchain RPC connection, and a malware-flagged third-party resource (xaz2.com, 2 feeds). Likely injected loader.

Risk Factors
Critical IDS malware alert (EtherHiding Exfil) present in network traffic
Blockchain RPC / EtherHiding pattern indicating loader activity
Third-party domain xaz2.com flagged as malware by two independent feeds
Primary domain flagged as malware loader (single-source)
Domain age information unavailable

Details

Page Title

Children’s Performing Arts Class | Thames Ditton, Molesey & Esher

Scan Type

public

Domain Name Analysis

Domain 'popstarperformers.co.uk' uses the United Kingdom country-code top-level domain (.co.uk) with no subdomain. Count 17 characters in 'popstarperformers' holding 5 vowels versus 12 consonants. Word splitting yields two words: popstar, performers. Expect 8.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://popstarperformers.co.uk

Page Load Overview

4.59s
Total Load Time
602 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-GB
Text Length:4,310 chars
Detector Agreement:100%

Website Classification

Primary Category

education learning84% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

education learning
84%
entertainment media
64%
corporate
25%
news/blog
20%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.13.95Google · CDNUnited States
AS15169Google LLC
2142.250.154.95Google · CDNUnited States
AS15169Google LLC
2188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.14.94Google · CDNUnited States
AS15169Google LLC
2142.251.13.97Google · CDNUnited States
AS15169Google LLC
2142.251.150.119Google · CDNUnited States
AS15169Google LLC
2142.251.13.149Google · CDNUnited States
AS15169Google LLC
239--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1344209B1879679D42E6CEA01BBF7B97C0646A83B00327DD7C10F2D8D283A1DB9045C97

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:zUGlXbDN6BMD+gkdJfVzf4sJ2HQn/xE6oAi5a8zlvg/dP/xB/nkWHHDZUsBxE:zUG9fNwMKDfNQ62Ho/xE6x4aUg/5j/no

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:12223:E0BCDgAFx8XAxVvcgIwlKUCaWggTRfAhMRUmQjYAEc0CSOIErBqQK8CiQAqywJFnikcQJGRQDCaBgDhYCJaDkYu1eQEdQVOA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffff81818181df8f
Perceptual Hash:bdc692cc3b6439c1
Difference Hash:1640332b3333333a
Wavelet Hash:ffff81818181838f
Color Hash:#ac537e

Scan History

Scan history not available

Unable to load historical scan data