ScanMalware.com

Security Scan Report: niluhomeimprovement.com

Redirected to:
https://www.niluhomeimprovement.com/
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ea7ccd42-022b-4677-bf3e-ec371074a806Domain and IP registration (RDAP)/api/v1/rdap/ea7ccd42-022b-4677-bf3e-ec371074a806How often this domain was scanned/api/v1/domain/stats/niluhomeimprovement.comScan history for this domain/api/v1/domain/history/niluhomeimprovement.com?limit=15
This website contacted 15 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main domain is niluhomeimprovement.com and was registered 4 years 3 months ago.

Submitted URL: https://niluhomeimprovement.com/

Effective URL:
https://www.niluhomeimprovement.com/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 99%

10
Risk Score

Compromised contractor site serving a ClickFix fake-CAPTCHA that copies an mshta/LOLBin command to the clipboard and tells users to run it via Win+R — confirmed malware delivery; do not paste or run anything.

Risk Factors (5)
ClickFix fake-CAPTCHA social-engineering flow staging a shell command on the clipboard
Clipboard hijacking (clipboard_shell_injection) delivering an mshta/LOLBin payload
Impersonation of a Microsoft 'Windows Security' verification dialog
Known malicious kit signatures matched at CRITICAL/HIGH severity on the page HTML
Page title/headers are 'Verification Required' / 'Windows Security' while the site is a home-improvement contractor — content mismatch indicating compromise
Domain age information unavailable

Details

Page Title

Verification Required

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'niluhomeimprovement.com' is registered. The core label 'niluhomeimprovement' covers 19 characters holding 8 vowels versus eleven consonants. Breaking it apart gives four words: nil, u, home, improvement. Median word length is 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://niluhomeimprovement.com/

Page Load Overview

2.08s
Total Load Time
128 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:574 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical58% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

healthcare medical
58%
adult content
54%
news media journalism
51%
government public service
49%
documentation technical
49%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3192.185.6.227United States
AS19871Network Solutions, LLC
0142.251.110.97Google · CDNUnited States
AS15169Google LLC
0142.251.20.95Google · CDNUnited States
AS15169Google LLC
0216.239.32.36Google · CDNUnited States
AS15169Google LLC
0142.251.127.154Google · CDNUnited States
AS15169Google LLC
0192.178.183.94Google · CDNUnited States
AS15169Google LLC
0142.251.14.102Google · CDNUnited States
AS15169Google LLC
0104.26.12.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
020.250.198.32Azure · CLOUDZurich, Zurich, Switzerland
AS8075Microsoft Corporation
0142.251.14.94Google · CDNUnited States
AS15169Google LLC
315--

Detected Technologies2

Plesk
40%
Microsoft ASP.NET
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19274F673BDA30C39221F728FA05B735C89578ADBD125A2F1F4B28115DAB4D9137A238D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:M8C8sxtNHxW71itCcLCCLzBfe/oORrSjlit5kPz6EYzOOy/bfB5yXpzfuGXbdcuc:M8C8gNLCCZmgORrSjlit5kP2lkV

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:343998:g2gQHZJ0WwI5IAgqkC0AAoKFU1FGWYNWUAIMGAwB2DYISErBAIMEIwQlhggUxIiA4CNCAwuCCEbBIL4k7aYEMQIQ2CAPAAKs

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00c7838383c7ffff
Perceptual Hash:b434cb4b164b3e36
Difference Hash:c90e2e2e2e0f032c
Wavelet Hash:0083838383c3ffff
Color Hash:#2dd298

Other Hashes

Crop Resistant:c90e2e2e2e0f032c,29c9c9c929050101,4040404c4c404102

Scan History

Scan history not available

Unable to load historical scan data