ScanMalware.com

Security Scan Report: miniferez.shop

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/7f7976d8-cfeb-4100-a130-a7cfc5f03891Domain and IP registration (RDAP)/api/v1/rdap/7f7976d8-cfeb-4100-a130-a7cfc5f03891How often this domain was scanned/api/v1/domain/stats/miniferez.shopScan history for this domain/api/v1/domain/history/miniferez.shop?limit=15
This website contacted 3 IPs in 2 countries across 1 domain to perform 2 HTTP transactions. The main domain is miniferez.shop.

Submitted URL: https://miniferez.shop

AI Security Verdict

High Risk

Confidence: 90%

8
Risk Score

Roster-anchored IClickFix EtherHiding hunting-rule hit on a compromised Persian tool-shop page: injected loader fetches an encrypted stage from an Ethereum Sepolia contract for Windows visitors. No forms or phishing. Treat the host as infected.

Risk Factors (3)
Analyst-vetted ClickFix / EtherHiding malware loader injected into the page's HTML
Primary domain reported as a malware loader by a threat-intel feed (single-source, unverified)
Content mismatch: datacenter scanner received 502 Bad Gateway while a residential client received the real page — consistent with the site serving different content by visitor, though bot protection is a common benign cause
Domain age information unavailable

Details

Page Title

فروشگاه آنلاین ابزار مینی فرز – تخصصی ترین مرجع خرید ابزارآلاتother network

Scan Type

public

Domain Name Analysis

Within the commerce-oriented generic top-level domain (.shop), 'miniferez.shop' is registered with no subdomain. Its registrable label 'miniferez' stretches across 9 characters holding 4 vowels versus five consonants. Tokenizing the label suggests three words: mini, fe, rez. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

538 ine slp! GpLLT olSuig 5S SUT KLo GI9JA j39 Gino ylisl YZULT olKuisg 4S SUTIR! 25 aay cee aads oon

Page Load Overview

0.40s
Total Load Time
0 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:100%
Script:Latin
Direction:ltr

Detection Details

Text Length:49 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2185.106.200.60Iran
AS212216Netafraz Iranian Ltd.
0142.251.14.95Google · CDNUnited States
AS15169Google LLC
080.191.36.26Iran
AS58224Iran Telecommunication Company PJS
23--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FA933B73B21B1EDD27675748D4B9BA4CE24E9D8ACA894972FFB80D0CD2E45F41042B1E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:fF7d9JPvypNa9A5atAUAv8CArmDkziFaiwdR/YuyeCq69CcqUXMh3qNwsRXknloP:fRdb6G9A5eAUAvRArmngYuyeCqUCcTX5

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:91104:aYBCEmyEcACGWIYCMBATchpKEBNmABKQCL6IFArhkvyxAoAMBgMEZNOEoAxqwAFGoALoQox9kdKgBSTYCGmBDKAMBGAgJ+U0

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:b1ffffe7e7ffffe7
Perceptual Hash:af0f0f0f270d0f23
Difference Hash:6304000c0c000008
Wavelet Hash:004e3e02c2fefee6
Color Hash:N/A

Other Hashes

Crop Resistant:6304000c0c000008

Scan History

Scan history not available

Unable to load historical scan data