Security Scan Report: weekandesign.it

Site favicon
Submitted: Completed: publiccompleted
This website contacted 26 IPs in 3 countries across 18 domains to perform 347 HTTP transactions. The main domain is weekandesign.it and was registered 16 years ago.

Submitted URL: https://weekandesign.it

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Compromised long-established Italian design blog now serving a ClickFix/Cloudflare-lookalike overlay that pushes Windows users to paste attacker commands into Terminal, alongside EtherHiding blockchain RPC abuse and CRITICAL malware IDS alerts.

Risk Factors (5)
Known ClickFix Win+X Terminal lure kit injected into the page (analyst-vetted roster match)
YARA HIGH-severity match for fake verification + Terminal paste execution
20 CRITICAL IDS alerts for EtherHiding exfiltration
Cross-origin fetches to BSC testnet blockchain RPC endpoints from page scripts
Primary domain flagged as 'unknown loader' malware (single-source) and reproduces a fake Cloudflare verification page
Domain age information unavailable

Details

Page Title

WEeKanDesign.it ~ grafica, cancelleria, organizzazione e scrapbooking

Scan Type

public

Domain Name Analysis

Domain 'weekandesign.it' uses the Italian country-code top-level domain (.it) with no subdomain. Count 12 characters in 'weekandesign' holding five vowels versus 7 consonants. Breaking it apart gives 3 words: week, an, design. Average segment length settles at 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://weekandesign.it

Page Load Overview

38.37s
Total Load Time
4.2 MB
Total Size

Language Analysis

Primary Language

🇮🇹Italian
Code: it
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:it-IT
Text Length:3,221 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network55% confidence
Type: spa
Method: ml+structural+ocr_tiebreaker

All Detected Categories

social media network
55%
corporate
35%
news/blog
20%

Detected Features

Search
Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
22185.2.4.73Italy
AS39729Register S.p.A.
13172.66.171.172Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
133.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
13142.215.53.55Washington, District of Columbia, United States
AS15830Equinix (EMEA) Acquisition Enterprises B.V.
1335.71.129.99Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
13104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1315.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1315.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
13104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13104.18.37.200Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
34726--

Detected Technologies11

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1EE64B052539A98FC33BE57A8163CB744A35EAA02CDC59ADDF179C09C22CCD9D066330E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:I7zdxNQSWZ86Snrq+dJRYP9xV1X8gm6NPZkrDIqRmO:I1FBJY7bsD1mO

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:336695:J0ZYSyGVXFRoQaeSQggAMsBg2lDIJAQIAaGmIgIBJtAlOLBIh4StATxIAWrKAAHKwwcpQAQhg0oENBYQCBks0IJKLYUQUCTg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:808080e7ffffabbb
Perceptual Hash:fd782d8187c7c624
Difference Hash:33372a4a1e2a1637
Wavelet Hash:808080e6c7ffabbb
Color Hash:#c5c087

Other Hashes

Crop Resistant:33372a4a1e2a1637

Scan History

Scan history not available

Unable to load historical scan data