Security Report: mhsohan.site - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/87a535fc-1abc-42b2-9a4a-789d15948c3f Domain and IP registration (RDAP)/api/v1/rdap/87a535fc-1abc-42b2-9a4a-789d15948c3fHow often this domain was scanned/api/v1/domain/stats/mhsohan.site Scan history for this domain/api/v1/domain/history/mhsohan.site?limit=15

This website contacted 11 IPs in 2 countries across 9 domains to perform 59 HTTP transactions. The main domain is mhsohan.site and was registered 8 months ago.

Submitted URL: https://mhsohan.site

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Compromised portfolio site serving an injected ClickFix 'Cloudflare verification' overlay that tells Windows users to open Terminal and run attacker-supplied commands, with blockchain-based (EtherHiding) stage loading and multiple CRITICAL malware IDS alerts.

Risk Factors (5)

Known malicious ClickFix kit injected into the page (analyst-vetted kit roster, CRITICAL)

Fake Cloudflare 'Human Verification' overlay instructing visitors to open Terminal via Win+X and execute pasted content

EtherHiding: malware stage address retrieved from a blockchain smart contract via RPC calls (polygon.gateway.tenderly.co, rpc.ankr.com, etc.)

Obfuscated script concealing threat-feed hosts (1rpc.io, polygon.drpc.org, polygon.gateway.tenderly.co)

Multiple CRITICAL IDS malware alerts (EtherHiding exfiltration, ClickFix domain, exploit kit checkin)

Domain age information unavailable

Details

Page Title

Home - MH Sohan

Scan Type

public

Favicon Hash

MMH3: 530492348

MD5: dcab89b8e04bf53fcd7f6a44a8cb4fae

Domain Name Analysis

The domain 'mhsohan.site' uses the .site top-level domain while skipping any subdomain. Its registrable label 'mhsohan' stretches across 7 characters split between two vowels and five consonants. Word splitting yields three words: mh, so, han. The median word length lands at 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.28s

Total Load Time

6.3 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:1,219 chars

Detector Agreement:50%

Website Classification

Primary Category

technology software62% confidence

Type: spa

Method: ml+structural

All Detected Categories

technology software

62%

cryptocurrency blockchain

45%

corporate

35%

documentation technical

29%

Detected Features

Articles

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
9	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
5	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
5	104.20.24.117Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	104.26.5.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
5	172.66.150.162Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
59	11	-	-