ScanMalware.com

Security Scan Report: allstates-us.com

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Hostinger default page hijacked to serve EtherHiding/ClearFake malware: a fake Cloudflare check tells users to paste and run a PowerShell clipboard payload, with 19 CRITICAL IDS hits and a multi-feed malware IoC on the domain.

Risk Factors (5)
Fake bot-verification CAPTCHA instructing users to run commands in PowerShell/Terminal (ClickFix social engineering, not a real challenge)
EtherHiding malware exfiltration alerts (ET MALWARE, CRITICAL) on 19 separate network events
Primary domain flagged as 'clearfake' malware by two independent intelligence feeds
Blockchain smart-contract host (bnbchain.org testnet) loaded as a resource, consistent with smart-contract-based malware C2
Impersonates Cloudflare's security-verification branding while delivering host-level instructions
Domain age information unavailable

Details

Page Title

Default page

Scan Type

public

Domain Name Analysis

The domain name 'allstates-us.com' uses the commercial generic top-level domain (.com). The second-level label 'allstates-us' is 12 characters long split between four vowels and 7 consonants, along with one hyphen. Segmentation suggests 3 words: all, states, us. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://allstates-us.com

Page Load Overview

1.61s
Total Load Time
164 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,112 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software82% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
82%
documentation technical
64%
government public service
49%
phishing scam
38%
adult content
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.110.95Google · CDNUnited States
AS15169Google LLC
4104.16.56.10Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.14.94Google · CDNUnited States
AS15169Google LLC
415.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
4104.16.57.10Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
434.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
4104.21.27.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
43.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
409--

Detected Technologies3

Cloudflare Bot Management
85%
HTTP/3
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1E5821CEA12E192E46001A3F5A6657058B55354BFB3C6CE64F3DC1F84FF125DC9487AC8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:h7dIIUkgkKykWLMoLF8Zpff/a4UEkyl+P:h120kWLNLF0fq9Ekyl+P

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:18139:VkJSWAIQCEwEM3AEGgG4QMJQxgQnChLrhABRoOQwQMcABBJk9HBM3lTlABhEQIAiglBRwxYAwkCEjDhEInCKCGYgAhQCEZTF

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffefe7e7ffffff
Perceptual Hash:b3594c4e33734c59
Difference Hash:30005a4c4c0c4c10
Wavelet Hash:0018c0c0c3c3e7ff
Color Hash:#865c2d

Other Hashes

Crop Resistant:00505c4c4c0c0c10,0008343230240000

Scan History

Scan history not available

Unable to load historical scan data