Security Report: mhe.engineering - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/93b5d462-ee04-4f99-8ad1-acd4148bbd1a Domain and IP registration (RDAP)/api/v1/rdap/93b5d462-ee04-4f99-8ad1-acd4148bbd1aHow often this domain was scanned/api/v1/domain/stats/mhe.engineering Scan history for this domain/api/v1/domain/history/mhe.engineering?limit=15

This website contacted 13 IPs in 2 countries across 8 domains to perform 127 HTTP transactions. The main domain is mhe.engineering and was registered 8 years ago.

Submitted URL: https://mhe.engineering

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Legitimate 2018 engineering firm whose site is compromised and serving a ClickFix 'Human Verification' overlay that lures Windows users into pasting blockchain-loaded malware via Terminal; do not visit or follow the on-screen steps.

Risk Factors (5)

Known ClickFix/EtherHiding malware kit injected into the page (analyst-vetted roster match, CRITICAL)

Deceptive 'Human Verification' overlay impersonating Cloudflare, instructing Windows users to open Terminal and paste clipboard content

Obfuscated JavaScript that retrieves its payload address from a Polygon smart contract (EtherHiding)

Threat-feed-listed hosts (1rpc.io, polygon.gateway.tenderly.co) hidden only after deobfuscation

CRITICAL IDS malware alerts for EtherHiding exfiltration; exploit-kit domain cloud-browse.codes loaded as a sub-resource

Domain age information unavailable

Details

Page Title

MHE Engineering - Providing Services within Canada & Internationally

Scan Type

public

Domain Name Analysis

Within the .engineering top-level domain, 'mhe.engineering' is registered and has no subdomain. Its registrable label 'mhe' stretches across 3 characters containing one vowel alongside 2 consonants. Segmentation suggests 2 words: m, he. The median word length lands at 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.79s

Total Load Time

2.5 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:1,879 chars

Detector Agreement:60%

Website Classification

Primary Category

technology software65% confidence

Type: spa

Method: ml+structural

All Detected Categories

technology software

65%

documentation technical

55%

social media network

40%

government public service

28%

news media journalism

26%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
19	50.116.95.110	Phoenix, Arizona, United States	AS31898Oracle Corporation
9	185.111.111.157	Frankfurt am Main, Hesse, Germany	AS212238Datacamp Limited
9	142.251.155.119Google · CDN	United States	AS15169Google LLC
9	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	172.66.146.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	142.250.154.94Google · CDN	United States	AS15169Google LLC
9	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
9	142.251.153.119Google · CDN	United States	AS15169Google LLC
9	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	142.251.156.119Google · CDN	United States	AS15169Google LLC
127	13	-	-