ScanMalware.com

Security Scan Report: firstagrotech.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/d13bceb8-d480-4d70-92cd-5c8a389de9deDomain and IP registration (RDAP)/api/v1/rdap/d13bceb8-d480-4d70-92cd-5c8a389de9deHow often this domain was scanned/api/v1/domain/stats/firstagrotech.comScan history for this domain/api/v1/domain/history/firstagrotech.com?limit=15
This website contacted 6 IPs in 2 countries across 6 domains to perform 58 HTTP transactions. The main domain is firstagrotech.com and was registered 10 months ago.

Submitted URL: https://firstagrotech.com

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Legitimate-looking Thai agrotech site that is compromised: injected ClickFix/EtherHiding loader, blockchain-delivered second stage, CRITICAL IDS malware alerts and a two-feed malware report on the domain. Do not visit.

Risk Factors (5)
Known malicious ClickFix/EtherHiding injection on the page (kit-roster ground truth)
Blockchain-based (EtherHiding/Sepolia) second-stage loader with obfuscated RPC endpoints
Multiple CRITICAL network IDS malware alerts tied to zvh4.com ClickFix infrastructure
Primary domain flagged as a malware loader by two independent threat-intelligence feeds
Obfuscated exfiltration beacon to a third-party SEO-solutions host
Domain age information unavailable

Details

Page Title

First Agrotech

Scan Type

public

Domain Name Analysis

The domain name 'firstagrotech.com' uses the commercial generic top-level domain (.com) and has no subdomain. The registrable portion 'firstagrotech' spans 13 characters split between four vowels and 9 consonants. Tokenizing the label suggests four words: first, a, gro, tech. The median word length lands at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://firstagrotech.com

Page Load Overview

8.78s
Total Load Time
21.8 MB
Total Size

Language Analysis

Primary Language

🇹🇭Thai
Code: th
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:th
Text Length:4,121 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate business89% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

corporate business
89%
adult content
53%
government public service
47%
healthcare medical
43%
corporate
25%

Detected Features

Search
OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
13103.86.48.160Bangkok, Bangkok, Thailand
AS58955Bangmod Enterprise Co., Ltd.
9142.251.14.95Google · CDNUnited States
AS15169Google LLC
9142.250.154.94Google · CDNUnited States
AS15169Google LLC
9172.67.209.248Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
586--

Detected Technologies7

WordPressv7.0.2
100%
Open-Graph-Protocolvwebsite
100%
MetaGenerator
100%
PHP
50%
MySQL
50%
Nginx
40%
Bricks
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T146F3FA73A16974BE2E1F5B9879D6FF0CA1074117CB0E89F2A2E6004CD6D0BFA1512DDA

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:oRdWYtpPzjzw3mhNFmfpPbje7ep9ccqVMaMC:oRdP5jzphNFmfpPby7ep9ccqz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:169341:QShFCsCApoACEQgKBVQAKjqIOPMYStonwqM4CyqUSJYR0wrMSQBAUsQmODB0J3ikCBlMfsEELIJAiBSYAQlDASAQNoKoQHVw

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data