Security Scan Report: crestwaterdental.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 2 countries across 5 domains to perform 8 HTTP transactions. The main domain is crestwaterdental.com and was registered 16 years ago.

Submitted URL: https://crestwaterdental.com

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Compromised dental site serving a ClickFix fake Cloudflare 'Human Verification' overlay that tells Windows users to paste Terminal commands, pulling a payload address from a blockchain contract via EtherHiding.

Risk Factors (5)
ClickFix social-engineering overlay impersonating Cloudflare verification
EtherHiding: payload address fetched from a smart contract via public blockchain RPC endpoints
CRITICAL IDS alerts for EtherHiding exfiltration (x3)
Obfuscated script concealing known-attacker hosts
Legitimate 16-year-old dental domain appears compromised and serving an injected phishing/malware kit
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Domain 'crestwaterdental.com' uses the commercial generic top-level domain (.com) without a subdomain. The second-level label 'crestwaterdental' is 16 characters long holding 5 vowels versus 11 consonants. Breaking it apart gives three words: crest, water, dental. Median word length comes out to five characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://crestwaterdental.com

Page Load Overview

2.31s
Total Load Time
44 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:659 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software46% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
46%
cryptocurrency blockchain
44%
healthcare medical
34%
documentation technical
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
474.208.236.48United States
AS8560IONOS SE
1188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
1152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
1150.136.141.142Oracle · CLOUDAshburn, Virginia, United States
AS31898Oracle Corporation
85--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18D03E8328395612DD0274DE7A215371F30EDC8C7DA57066CB7A23EB4EA5FA4661BA308

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:LfNA8gagTILrHO+o163R3oKOUD3oKOX3oKOH9:iGO+o163xnQm9

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:39859:J6AMhDyslHgnSFADVJAIgMiB5YCBAEmRIgFG3NHQRB6W3xUUJE0CGYQwiAMAQ24JoCskADiKqs5AABpRECnxbbCgAoEgFQDV

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7c3c3fffffff7
Perceptual Hash:b030a3c7cecccccd
Difference Hash:0c1c163600000008
Wavelet Hash:3f0703033c3cff00
Color Hash:#b7bf40

Other Hashes

Crop Resistant:0c1c163600000008

Scan History

Scan history not available

Unable to load historical scan data