ScanMalware.com

Security Scan Report: helloshopper.co.za

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

High Risk

Confidence: 88%

9
Risk Score

Compromised-looking WooCommerce store serving ClickFix/EtherHiding malware: primary domain flagged as 'clearfake' by two feeds, seven CRITICAL IDS malware alerts and a fake 'Human Verification' prompt telling users to paste Terminal commands. Do not interact.

Risk Factors (5)
Content-malware threat-intel match on the primary scanned domain (two independent feeds)
Multiple CRITICAL IDS malware alerts (EtherHiding exfiltration, ClickFix domain)
Active ClickFix lure instructing visitors to open Terminal and paste a command
Loads third-party domains independently flagged as malicious hosts (checkyoubrowse.codes, rehearsal-b.com)
Connections to blockchain RPC / gateway endpoints associated with wallet-drainer and EtherHiding campaigns
Domain age information unavailable

Details

Page Title

Buy, Smile, Enjoy, Repeat - Hello Shopper

Scan Type

public

Domain Name Analysis

You're looking at domain 'helloshopper.co.za' on the South African country-code top-level domain (.co.za) without a subdomain. The core label 'helloshopper' covers 12 characters containing four vowels alongside eight consonants. Tokenizing the label suggests two words: hello, shopper. Median word length comes out to 6 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://helloshopper.co.za

Page Load Overview

17.38s
Total Load Time
5.6 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:2,416 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network80% confidence
Type: spa
Method: ml+structural

All Detected Categories

social media network
80%
e-commerce shopping
42%
corporate
35%
e-commerce
20%
news/blog
20%

Detected Features

Search
Articles
Products
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
20169.239.181.218South Africa
AS329184Host Africa (Pty) Ltd
10104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10172.67.70.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1035.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
10152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
10178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
10104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10104.21.95.226Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10172.66.164.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
12011--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BC340B7353201C2996AF07CBD0077329B1DEE606DE5A16D4F2F5C11BE6BEDE1242B628

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:m7CzefPsHpwmAzhcnXfb/ZhAFpjA4g7j42D+5CP/UwnMFXah7Z4GDO5qP9UoncFA:me6zHDhQ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:231143:SAKqUIAJBCTI0C9CBcCjAAgA+EKFBqZ4iEaeAkJugkewRhdWRgABbk1o42kKwgonAYYAAqkBRtAAdOCAM4hYkYNdBVKADhAQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffffffffffffff
Perceptual Hash:fa61787a613a6178
Difference Hash:9300000000212100
Wavelet Hash:0000c1c131ff9dff
Color Hash:#3a784c

Other Hashes

Crop Resistant:9300000000212100,41918db2b28d9141

Scan History

Scan history not available

Unable to load historical scan data