Security Scan Report: haierformazione.it

Site favicon
Submitted: Completed: publiccompleted
This website contacted 15 IPs in 2 countries across 15 domains to perform 42 HTTP transactions. The main domain is haierformazione.it and was registered 13 years ago.

Submitted URL: https://haierformazione.it

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Haier training site appears compromised: an analyst-vetted ErrTraffic/Exvicy WordPress loader, CRITICAL EtherHiding exfiltration alerts and decoded malicious hosts make the page unsafe to visit despite having no forms.

Risk Factors (5)
Injected ErrTraffic/Exvicy obfuscated loader (Base64 blob XOR-decoded and executed via new Function) embedded in the page
CRITICAL IDS malware alerts for EtherHiding exfiltration
Obfuscated script concealing a malicious IP and two malicious domains
Five corroborated malicious third-party resources loaded by the page (exploit-kit 'clearfake-1' family)
Primary domain itself carries a malware threat-intel report
Domain age information unavailable

Details

Page Title

Haier Formazione

Scan Type

public

Domain Name Analysis

You're looking at domain 'haierformazione.it' on the Italian country-code top-level domain (.it) while skipping any subdomain. The core label 'haierformazione' covers 15 characters holding eight vowels versus 7 consonants. Tokenizing the label suggests 4 words: haie, r, form, azione. Average segment length settles at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://haierformazione.it

Page Load Overview

24.55s
Total Load Time
763 KB
Total Size

Language Analysis

Primary Language

🇮🇹Italian
Code: it
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:it-IT
Text Length:2,390 chars
Detector Agreement:100%

Website Classification

Primary Category

education learning96% confidence
Type: spa
Method: ml+structural

All Detected Categories

education learning
96%
documentation technical
94%
adult content
34%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
14104.197.85.63Google · CDNCouncil Bluffs, Iowa, United States
AS396982Google LLC
2142.251.13.154Google · CDNUnited States
AS15169Google LLC
2104.21.3.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2192.178.183.95Google · CDNUnited States
AS15169Google LLC
2172.67.70.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2192.178.183.156Google · CDNUnited States
AS15169Google LLC
235.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
2178.83.75.4United Kingdom
AS43641SOLLUTIUM EU Sp z.o.o.
2142.251.20.155Google · CDNUnited States
AS15169Google LLC
4215--

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A1A40273A5C4511B032A01E4896BA71CFEBA8711CF869576B1FCB1501FE2FEB8473A19

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:Ojz86QI8CCF1wejlpEF612VK4S5uW8vt62nFSV:2z8F9CCF1ZEpVK4ez

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:462583:AIQRGAIAUBqBYAaCSIasiEwKDHsEBXvEE4Uol24WgoCEr6CMx2gI7QohIgAGQaawbLDukklJCIKoqTAAAKA0JoCMBZAMSRCY

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000001818000000
Perceptual Hash:8d07238f8d27339b
Difference Hash:c0304cb2b24c3000
Wavelet Hash:0070767e7e7e6e00
Color Hash:#d22d9b

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data