ScanMalware.com

Security Scan Report: evergreenyib.com

Site favicon
Submitted: Oct 9, 2026, 6:11:34 PMCompleted: Oct 9, 2026, 6:13:26 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 88%

9
Risk Score

Legitimate-looking Indian rock-breaker WordPress site that is compromised: its primary domain is tagged ClearFake malware and the page loads Ethereum/Polygon contracts to fetch hidden payloads (EtherHiding), confirmed by critical IDS alerts. Do not visit.

Risk Factors (5)
Primary domain and requested URL carry multi-source ClearFake malware Indicators of Compromise
Critical network IDS alerts for EtherHiding exfiltration (x3)
Blockchain RPC querying used to fetch/hide malicious payloads from smart contracts
Multiple externally loaded domains blacklisted as ClearFake malware infrastructure
WordPress site appears compromised — clean industrial content masking injected malware delivery
Domain age information unavailable

Details

Page Title

Home - Evergreen Enterprisesother network

Scan Type

public

Domain Name Analysis

You're looking at domain 'evergreenyib.com' on the commercial generic top-level domain (.com) without a subdomain. Count 12 characters in 'evergreenyib' with five vowels and seven consonants. Word splitting yields 3 words: evergreen, yi, b. Average segment length settles at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://evergreenyib.com

Page Load Overview

75.10s
Total Load Time
37.3 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:6,291 chars
Detector Agreement:80%

Website Classification

Primary Category

corporate35% confidence
Type: spa
Method: ml+structural

All Detected Categories

corporate
35%
documentation technical
33%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
19148.251.82.243Falkenstein, Saxony, Germany
AS24940Hetzner Online GmbH
13142.251.14.95Google · CDNUnited States
AS15169Google LLC
13188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13142.251.13.94Google · CDNUnited States
AS15169Google LLC
13104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13158.94.211.226Rotterdam, South Holland, Netherlands
AS202412Omegatech LTD
13142.251.127.95Google · CDNUnited States
AS15169Google LLC
13172.66.164.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
17513--

Detected Technologies11

WordPressv7.1.3
100%
Open-Graph-Protocolvwebsite
100%
MetaGenerator
100%
JQueryv1.0.0
100%
Bootstrapv2.0.1
100%
PHP
50%
MySQL
50%
SpeedyCache
40%
HTTP/3
40%
particles.js
20%
Swiper
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DD341A31BA58587A326F02CED00F221C50ABDBB6D6419AF5F1BB4128B3F2DD135A3597

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:t3ZANC0G+jk0PdTiAtAemz5gwo5Vijmz5gwo5VPMC6vAil7G5yxmPs6BrpbCAT3z:52tdAg0rqC64B

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:243184:IAoBSmj2GlAOQIKGkEYRgAKoAECAAxFQZkqRDwhu6nhwCARYKcgKUUV4AQrIQWxyoCiFMJGcZEAECqTSzDVADogEDSmECgAl

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff38000000ffffdf
Perceptual Hash:f543b8e718a1705e
Difference Hash:9242d0946cc6663a
Wavelet Hash:fb30000000ffffdf
Color Hash:#8c40bf

Other Hashes

Crop Resistant:0200221212220052,7086864fca33363a,00c494c4cc949400,5240f090d06c2c64

Scan History

Scan history not available

Unable to load historical scan data