ScanMalware.com

Security Scan Report: ecohimprom.bg

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e32d6fdf-c3a6-4ca0-93ef-65f7199953eaDomain and IP registration (RDAP)/api/v1/rdap/e32d6fdf-c3a6-4ca0-93ef-65f7199953eaHow often this domain was scanned/api/v1/domain/stats/ecohimprom.bgScan history for this domain/api/v1/domain/history/ecohimprom.bg?limit=15
This website contacted 6 IPs in 2 countries across 6 domains to perform 149 HTTP transactions. The main domain is ecohimprom.bg.

Submitted URL: https://ecohimprom.bg

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Legitimate Bulgarian equipment company site that is compromised: a ClearFake Polygon blockchain loader and a ClearFake-flagged third-party host (seaopencd.com) are present, exposing visitors to malware. Treat as unsafe until cleaned.

Risk Factors (4)
ClearFake blockchain contract loader (Polygon/EtherHiding) identified by analyst-vetted kit roster and hunting-rule match
External script host seaopencd.com flagged as ClearFake malware by two independent threat feeds
Primary domain reported as 'unknown loader (malware)' in threat intelligence
Obfuscated JavaScript usage indicators on a business brochure site
Domain age information unavailable

Details

Page Title

Ecohimprom – Main websiteother network

Scan Type

public

Domain Name Analysis

Within the Bulgarian country-code top-level domain (.bg), 'ecohimprom.bg' is registered while skipping any subdomain. Count 10 characters in 'ecohimprom' holding 4 vowels versus 6 consonants. Tokenizing the label suggests 3 words: eco, him, prom. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ecohimprom.bg

Page Load Overview

N/A
Total Load Time
2.2 MB
Total Size

Language Analysis

Primary Language

🇧🇬BG
Code: bg
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:bg-BG
Text Length:10,028 chars
Detector Agreement:75%

Website Classification

Primary Category

unknown0% confidence
Type: spa
Method: structural

All Detected Categories

No categories detected

Detected Features

Login Form
Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
29192.250.229.165Frankfurt am Main, Hesse, Germany
AS209341WHG Hosting Services Ltd
24188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
24142.250.154.95Google · CDNUnited States
AS15169Google LLC
24142.251.20.95Google · CDNUnited States
AS15169Google LLC
24142.251.20.94Google · CDNUnited States
AS15169Google LLC
24142.251.154.4Google · CDNUnited States
AS15169Google LLC
06--

Detected Technologies4

WordPressv7.0.7
100%
PasswordField
100%
MetaGenerator
100%
JQueryv3.7.1
100%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D324E7727E462C66110F02CFE027765D60C796EAEB1281E1B5F1036DA6F1DF036F26A9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:wpNgAIkAZAWhAQVC8f8HYPuVGtfL0POhxq3POMxnQD34inD41EGp3UvAZhpP+get:I+yngEHYPuVGQxnQz4ins1EGp3U4tcr

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:218912:kNVCCoBRNAFBEEhLYAS0wDQ+gwEqelgiGMBVAoDWAqQQyT1RHUgSpRMDrwowoGESgCFCLtgALhS5gAQEIzIOgiCQFIAICAhp

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffffffc080c387
Perceptual Hash:b4c93f6a06b51a71
Difference Hash:b293b8c6862d0e0d
Wavelet Hash:00ffffff00808387
Color Hash:N/A

Other Hashes

Crop Resistant:b293b8c6862d0e0d,e88c4e98244eca92,6d6683c3c1c0ccd4,8542b2aa4176b697,eed68e261d0e0e0d

Scan History

Scan history not available

Unable to load historical scan data