ScanMalware.com

Security Scan Report: safirdoor.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/d2f2ce57-9c9e-4417-9692-f48971720749Domain and IP registration (RDAP)/api/v1/rdap/d2f2ce57-9c9e-4417-9692-f48971720749How often this domain was scanned/api/v1/domain/stats/safirdoor.comScan history for this domain/api/v1/domain/history/safirdoor.com?limit=15
This website contacted 7 IPs in 2 countries across 7 domains to perform 89 HTTP transactions. The main domain is safirdoor.com and was registered 8 years ago.

Submitted URL: https://safirdoor.com

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Legitimate-looking automatic-door shop whose page is compromised and serving an IClickFix/EtherHiding malware loader via obfuscated blockchain-backed scripts — do not interact.

Risk Factors (5)
Compromised-site injection delivering a ClickFix/EtherHiding malware loader
Obfuscated script concealing known-attacker hosts (0xrpc.io, 1rpc.io, gateway.tenderly.co) and reading its payload from a blockchain smart contract
CRITICAL IDS malware alerts (ET MALWARE EtherHiding Exfil M2)
Primary domain flagged as a malware loader and linked to the IClickFix kit
Blockchain RPC connections used as a covert payload channel
Domain age information unavailable

Details

Page Title

خانه - درب اتوماتیک سفیر

Scan Type

public

Domain Name Analysis

You're looking at domain 'safirdoor.com' on the commercial generic top-level domain (.com). The core label 'safirdoor' covers 9 characters with four vowels and 5 consonants. Word splitting yields 4 words: s, a, fir, door. Median word length is two characters. No strong language cues emerged from the frequency lists.

Screenshot

pbc’ |oay9 (E- lnaiws dam grime Q BY wl Gsle pil) Gy Ob lw Sina) YES gay Gy Jad Sagi OSS yoigo Klagil SS aa | KUHL KSlogil ys gl tend Sagi! ays GENS A995) SD SlpaS | ))a)/M 0990 Moyolinn 95) 922...

Page Load Overview

90.13s
Total Load Time
1.1 MB
Total Size

Language Analysis

Primary Language

🇮🇷Persian
Code: fa
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:fa-IR
Text Length:5,806 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical73% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
73%
technology software
67%
government public service
57%
real estate property
45%
adult content
39%

Detected Features

Search
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1793.95.27.68Iran
AS212216Netafraz Iranian Ltd.
12185.143.234.1Arvancloud · CDNIran
AS205585Noyan Abr Arvan Co. ( Private Joint Stock)
12212.16.67.4Iran
AS34837Institute for Research in Fundamental Sciences
12185.143.233.1Arvancloud · CDNIran
AS205585Noyan Abr Arvan Co. ( Private Joint Stock)
12188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
12172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
12104.21.5.110Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
897--

Detected Technologies13

WordPressv7.0.8
100%
Open-Graph-Protocolvwebsite
100%
MetaGenerator
100%
JQueryv3.7.1
100%
WooCommercev10.4.3
60%
PHP
50%
MySQL
50%
Nginx
40%
Elementorv3.34.0
40%
Yoast SEO Premiumv21.7
30%
Yoast SEOv26.6
30%
jQuery Migrate
20%
Contact Form 7
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FF24A4F256F8A2671207A2DB64522E4F7B97411FD6E0A610B3FC475C8F9ACE325221CD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:7VQEXEhNxhvFq/TzJbnUPEczAYOjoFWMjNqSEQbOjDtkfbo8kZuEOb2CKHlM1w6k:A/S

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:225089:PeIlCBiALAYMEKAtkCEn0THCVowBMkEobRGIkIAFAKJQAZCAJBQ8CYoQQUFCAguT0QJdIWixJlrERxBxgAksXAJgUbAjbqIC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc3c1c1c1ffdbff
Perceptual Hash:e9639293c91e966c
Difference Hash:400b2f03130b3387
Wavelet Hash:fec1c18181ff8363
Color Hash:06000030000

Other Hashes

Crop Resistant:400b2f03130b3387,aeae8e8ecece8fbf,2c0a957542092626,210303035357c6f7

Scan History

Scan history not available

Unable to load historical scan data