Security Scan Report: surreyjunkremovalguy.ca

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Legitimate-looking Surrey junk removal site whose pages have been compromised: obfuscated scripts hide iclickfix malware hosts and drive BSC-testnet RPC traffic, triggering 20 CRITICAL EtherHiding exfiltration IDS alerts.

Risk Factors (5)
Critical IDS signature for malware exfiltration (EtherHiding) repeated 20 times
Obfuscated script containing three decoded threat-feed hostnames flagged as iclickfix malware (campaigntracker.icu, campaigntracker.top, privatehub.icu)
Primary domain reported as a malware loader in threat intelligence
Malicious third-party resource trackerredirect.online (iclickfix, corroborated by 2 feeds) loaded by the page
Scripts communicating with blockchain RPC nodes for no legitimate site purpose (blockchain-based payload/C2 channel)
Domain age information unavailable

Details

Page Title

Surrey Junk Removal Guy - Rubbish & Furniture Removal - 6049003672

Scan Type

public

Domain Name Analysis

Within the Canadian country-code top-level domain (.ca), 'surreyjunkremovalguy.ca' is registered with no subdomain. The registrable portion 'surreyjunkremovalguy' spans 20 characters split between 7 vowels and 13 consonants. Word splitting yields four words: surrey, junk, removal, guy. Average segment length settles at 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://surreyjunkremovalguy.ca

Page Load Overview

16.23s
Total Load Time
8.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:10,579 chars
Detector Agreement:100%

Website Classification

Primary Category

blog personal website78% confidence
Type: spa
Method: ml+structural

All Detected Categories

blog personal website
78%
government public service
75%
real estate property
69%
technology software
53%
adult content
51%

Detected Features

Search
Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
870.40.220.117Phoenix, Arizona, United States
AS46606Unified Layer
3172.67.69.204Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.110.95Google · CDNUnited States
AS15169Google LLC
3185.92.183.208Riga, Riga, Latvia
AS56971Cgi Global Limited
399.84.152.83Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
315.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
3104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.215.53.55Washington, District of Columbia, United States
AS15830Equinix (EMEA) Acquisition Enterprises B.V.
315.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
335.71.129.99Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
18259--

Detected Technologies10

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T149A46BF3E9005C6A06F28592E0B67618E261402FDE42749EB3AF216D0FDDD9F2975B1C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:PNsCFMxx+YqCnNLpiWs6bwXRnYvY5roIXU7N:Ex+KLpP

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:450504:EEgZBJLCVKgBVD6NAYQL28AmKLCAIhYAjCIG0x4awhOUR0APAWGjAYWOJq+qQAsAAmMDg4DHwSAwMgkig6lQAqhsCgMJBoYg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fefeffffffffffff
Perceptual Hash:d5555555555515aa
Difference Hash:0000000000000000
Wavelet Hash:0202020202020202
Color Hash:#c587b7

Other Hashes

Crop Resistant:0000000000000000

Scan History

Scan history not available

Unable to load historical scan data