ScanMalware.com

Security Scan Report: gridint.net

Site favicon
Submitted: Oct 14, 2026, 5:05:10 PMCompleted: Oct 14, 2026, 5:06:01 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Legitimate-looking Indian energy analytics site (gridint.net) whose page is compromised and serves a ClickFix/EtherHiding loader: vetted kit roster, YARA match, CRITICAL EtherHiding IDS alert and malware threat-intel hits. Do not interact.

Risk Factors (5)
Known malicious ClickFix/EtherHiding kit identified by analyst-vetted kit roster
YARA malware signature match in page HTML (IClickFix_Sepolia_EtherHiding_Loader)
CRITICAL network IDS alert ET MALWARE EtherHiding Exfil
Obfuscated script reads its next stage from a blockchain contract (EtherHiding), hiding threat-feed hosts
Threat-intel malware loader classification for the primary domain and for a loaded third-party domain (zvh3.com)
Domain age information unavailable

Details

Page Title

Grid Intelligence – India’s first agentic energy analytics solution

Scan Type

public

Domain Name Analysis

Domain 'gridint.net' uses the network infrastructure generic top-level domain (.net). The second-level label 'gridint' is 7 characters long split between two vowels and five consonants. Breaking it apart gives three words: grid, in, t. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://gridint.net

Page Load Overview

13.47s
Total Load Time
19.6 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:7,588 chars
Detector Agreement:75%

Website Classification

Primary Category

government public service30% confidence
Type: spa
Method: ml+structural

All Detected Categories

government public service
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
18185.123.53.189Tallinn, Harjumaa, Estonia
AS62005BlueVPS OU
8142.251.154.119Google · CDNUnited States
AS15169Google LLC
8172.67.147.199Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8142.251.14.95Google · CDNUnited States
AS15169Google LLC
8199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
8142.251.127.94Google · CDNUnited States
AS15169Google LLC
8104.17.208.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8142.251.127.84Google · CDNUnited States
AS15169Google LLC
8104.26.13.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8172.67.175.246Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13015--

Detected Technologies8

WordPressv7.1.3
100%
MetaGenerator
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%
HTTP/3
40%
WordPress Site Editor
30%
WordPress Block Editor
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16814F97153A469B67C7F8B98E15CF7595208EA02DE0256D9F0E8E058D2CCCFA54B3B0E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:shlaHQZb85gGiQ5gGiH5gGik2RAHQRbQ5gGi25gGifu5TP:gwyV

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:205242:GyILE+wYECMacAECABwAUhAEXAAASQgMJklZYIpNBCyGIEgZBN1OEAMAUGEKL0hKGBFIE6CQdPxUUiZYJwBGNEAAigk4BKQg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:9799191910111d0f
Perceptual Hash:9a6db265944db265
Difference Hash:3633b3373731310d
Wavelet Hash:d7df191911191d0f
Color Hash:#c387c5

Other Hashes

Crop Resistant:0303fbbbeb6b9b2f,3633b3373731310d

Scan History

Scan history not available

Unable to load historical scan data