ScanMalware.com

Security Scan Report: 21-realty.com

Site favicon
Submitted: Sep 23, 2026, 1:18:36 PMCompleted: Sep 23, 2026, 1:20:41 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 90%

9
Risk Score

Compromised real-estate WordPress site injecting EtherHiding/ClickFix malware via blockchain RPC calls; multiple CRITICAL IDS malware alerts and threat-intel malware matches. Avoid.

Risk Factors
Multiple CRITICAL network IDS malware alerts (EtherHiding exfiltration, AMOS/ClickFix loader)
Threat-intel malware match on the primary domain and its URL (independent feeds)
Blockchain RPC calls used to retrieve/host malicious payloads (EtherHiding pattern)
eval() and Function() constructor usage indicating dynamic/obfuscated code execution
Injected gambling-spam content on what should be a real estate site, indicating compromise
6 cross-domain redirects and connectivity to suspicious .life domain
Domain age information unavailable

Details

Page Title

21 REALTY – Your trustable real estate advisors

Scan Type

public

Domain Name Analysis

The domain name '21-realty.com' uses the commercial generic top-level domain (.com) without a subdomain. The registrable portion '21-realty' spans 9 characters split between 2 vowels and four consonants; bonus characters include two digits and one hyphen. Tokenizing the label suggests 2 words: 21, realty. Average segment length settles at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://21-realty.com

Page Load Overview

18.85s
Total Load Time
4.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:19,735 chars
Detector Agreement:75%

Website Classification

Primary Category

real estate property97% confidence
Type: spa
Method: ml+structural

All Detected Categories

real estate property
97%
entertainment media
95%
finance banking
95%
blog personal website
94%
gambling betting
94%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1450.87.219.149Phoenix, Arizona, United States
AS46606Unified Layer
3142.250.154.95Google · CDNUnited States
AS15169Google LLC
3138.124.60.214Switzerland
AS203273NetCrafters OU
3142.251.13.95Google · CDNUnited States
AS15169Google LLC
3104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.14.97Google · CDNUnited States
AS15169Google LLC
3142.251.110.94Google · CDNUnited States
AS15169Google LLC
33.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
33.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
315.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
9528--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T110A3529BF2D850EF653F8929429DB67CFC3CA050D74A3A95B0ADB3344B8D9EB045921C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:VGZYypUwqRLUYXaldlMlWlBaXD2JOnxn+PZMfGVobhODoSIRuOK3a:VGZ5RM23a

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:99657:xRCUYgjWYQQACUYJFZAjmHIgkR5KIRIGHFgQAqsIPESJYYTNOYoIEQqSADSg0QCzghIAn3BzoJohKMMJCMMIEFGMgiOgRRF1

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffc38183ffffff
Perceptual Hash:bd3c96163c3c427a
Difference Hash:2e262333331f3b0e
Wavelet Hash:00c3818181cfffff
Color Hash:#3f3a78

Other Hashes

Crop Resistant:2e262333331f3b0e,0004098c8c8c0200

Scan History

Scan history not available

Unable to load historical scan data