ScanMalware.com

Security Scan Report: rijschoolpegasus.nl

Site favicon
Submitted: Sep 22, 2026, 10:47:29 PMCompleted: Sep 22, 2026, 10:48:29 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Legitimate 17-yr-old Dutch driving school whose site appears COMPROMISED: critical EtherHiding malware IDS hit, blockchain exfil endpoint and a malware-flagged third-party resource load. Avoid interaction.

Risk Factors (4)
Critical malware IDS alert (EtherHiding blockchain exfiltration) on the scanned page
Third-party malware resource (xaz2.com) loaded by the page
Primary domain IoC matching a stealer (single-source)
Blockchain C2/exfil endpoint (nodies.app) referenced — hallmark of compromised-site script injection
Domain age information unavailable

Details

Page Title

Rijschool Pegasus - De rijschool Gorinchem en omstreken

Scan Type

public

Domain Name Analysis

Domain 'rijschoolpegasus.nl' uses the Dutch country-code top-level domain (.nl) with no subdomain. Its registrable label 'rijschoolpegasus' stretches across 16 characters holding 6 vowels versus 10 consonants. Tokenizing the label suggests 3 words: rij, school, pegasus. Median word length comes out to 6 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://rijschoolpegasus.nl

Page Load Overview

6.03s
Total Load Time
1.9 MB
Total Size

Language Analysis

Primary Language

🇳🇱Dutch
Code: nl
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:nl-NL
Text Length:3,357 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate70% confidence
Type: spa
Method: structural

All Detected Categories

corporate
70%
news/blog
60%

Detected Features

Search
Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
13104.21.72.220Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.20.95Google · CDNUnited States
AS15169Google LLC
3172.67.155.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.250.154.95Google · CDNUnited States
AS15169Google LLC
3104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.250.154.94Google · CDNUnited States
AS15169Google LLC
3188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.13.97Google · CDNUnited States
AS15169Google LLC
3142.251.110.139Google · CDNUnited States
AS15169Google LLC
3216.239.34.36Google · CDNUnited States
AS15169Google LLC
4612--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1ADC3F68E9BB231B4B117CB55FAEA6334576CC0139A1209F7BC71959C8FC225702B3A5E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:9k9i5Q62I/xE6x4g5bn/+WMT1Zdyp6irYmlQeRNjcXscJGcz74k/t++wALrdczEY:4iC7WMRypBrzG4kFwErdczE3I

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:123906:FqDIRAxQkJ8I2wExGlMZdMITc5EBEAYcABA1FCJpyChACLjOimnRHICESnYQZY02gFo1QTbIRQxAGQGYoCA7GbZCQhCGKmCk

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff0c02211060ffff
Perceptual Hash:8317bec8e8e1459d
Difference Hash:0e6c4ac3d1d3ab26
Wavelet Hash:ff0c22201060ffff
Color Hash:#6053ac

Other Hashes

Crop Resistant:0e6c4ac3d1d3ab26,0d0d0d0d0f0f183f,7f7f7f7c7c7a7b75,29ecd6b69396d447,793c9f0fa7c378bc,4f0f8fcf4f67e772

Scan History

Scan history not available

Unable to load historical scan data