Security Scan Report: qualicost.com

Redirected to:
https://qualicost.com/en/home/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 9 IPs in 3 countries across 9 domains to perform 62 HTTP transactions. The main domain is qualicost.com and was registered 13 years ago.

Submitted URL: https://qualicost.com/

Effective URL:
https://qualicost.com/en/home/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Legitimate Norwegian company's site appears compromised: victim pages serve an injected ClickFix fake Cloudflare 'Human Verification' overlay with EtherHiding blockchain loader. Never press Win+X or paste Terminal commands; avoid the site.

Risk Factors (5)
Injected ClickFix fake 'Human Verification' overlay instructing Windows users to open Terminal and paste a clipboard payload
EtherHiding blockchain-contract-driven loader (ET MALWARE EtherHiding Exfil M2, CRITICAL IDS)
Obfuscated script hiding known-attacker and blockchain RPC hosts
Third-party resource cloud-browse.codes flagged as an exploit kit (ek clearfake-1) by three feeds
Fake Cloudflare verification branding used to pressure victims
Domain age information unavailable

Details

Page Title

Increase Quality to Reduce Costs

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'qualicost.com' is registered. Count 9 characters in 'qualicost' containing four vowels alongside 5 consonants. Segmentation suggests three words: qu, ali, cost. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://qualicost.com/

Page Load Overview

13.36s
Total Load Time
18.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:2,632 chars
Detector Agreement:75%

Website Classification

Primary Category

corporate business68% confidence
Type: spa
Method: ml+structural

All Detected Categories

corporate business
68%
technology software
60%
government public service
43%
adult content
37%
documentation technical
26%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
14185.78.209.195Norway
AS202128Iteam Norge As
6142.251.110.95Google · CDNUnited States
AS15169Google LLC
6172.67.70.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6104.17.99.195Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6142.251.14.94Google · CDNUnited States
AS15169Google LLC
6216.198.54.3Cloudflare · CDNUnited States
AS209242Cloudflare London, LLC
6172.66.146.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
6104.17.98.195Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
629--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1CBB309F28558203F11275AD1D029B72AB2E6C252CE454A58F3FD63ACDBCFF9124B264D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:o3apcItSDI1bebO+o1635niryDsguwjB/tv7ldAwiNstGJN/ooEVKtg0WCmC:oqaItSDIRerKwUsEg0WC5

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:117381:AtACdJwpRcAE3EAIoFFABAEiAFECkkADCIFQADtiIUSoqGAmfwQAQweLclkoQMIQBiI0gcQQQgipBej4QouAAbmhUACDgIgg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:cfcfc3c3ffffffff
Perceptual Hash:b03193c7c6ccc6ce
Difference Hash:1818163600000008
Wavelet Hash:3f0f03030f0fdf00
Color Hash:#3a7877

Other Hashes

Crop Resistant:1818163600000008

Scan History

Scan history not available

Unable to load historical scan data