Security Scan Report: zejax.cz

Site favicon
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 2 countries across 5 domains to perform 64 HTTP transactions. The main domain is zejax.cz and was registered 23 years ago.

Submitted URL: https://zejax.cz

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Compromised legitimate motocross club site delivering IClickFix/EtherHiding malware via obfuscated scripts and blockchain-based C2; multiple critical IDS alerts confirm active malware distribution.

Risk Factors (5)
Known malicious kit IClickFix (Ethereum Sepolia loader and interseq[.]at overlay) injected into the page
EtherHiding technique observed: script reads next-stage address from a blockchain smart contract
Three CRITICAL network IDS alerts for malware exfiltration and ClickFix domain communication
Obfuscated JavaScript hides connections to threat-feed hosts (1rpc.io, gateway.tenderly.co, sepolia.gateway.tenderly.co)
Threat-intel match on loaded third-party domain zvh4.com (multi-source corroborated)
Domain age information unavailable

Details

Page Title

Automotoklub Zejax – Chrudim

Scan Type

public

Domain Name Analysis

The domain 'zejax.cz' uses the Czech country-code top-level domain (.cz) without a subdomain. The registrable portion 'zejax' spans 5 characters holding two vowels versus three consonants. Word splitting yields four words: ze, j, a, x. Average segment length settles at one character. No strong language cues emerged from the frequency lists.

Screenshot

| DOMŮ =» FOTO KONTAKT i

Page Load Overview

13.03s
Total Load Time
1.5 MB
Total Size

Language Analysis

Primary Language

🇨🇿Czech
Code: cs
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:cs
Text Length:7,477 chars
Detector Agreement:75%

Website Classification

Primary Category

unknown0% confidence
Type: spa
Method: structural

All Detected Categories

No categories detected

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
16185.8.237.11Czech Republic
AS208414WEDOS Internet, a.s.
12142.251.110.95Google · CDNUnited States
AS15169Google LLC
12104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
12188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
12142.251.13.94Google · CDNUnited States
AS15169Google LLC
645--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T163E31AF657B880F5266F1BE9EFB96B8C261E92B9DA416EC472FCD444C2C2DD10603E14

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:4RdRdpRLoz0zq+9DoFAgAYVAAOtfsTYfOTYfCTQHrfgeefR9DtvJroGo0:4RdPDVe3TYfOTYfOt5oGo0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:145948:KCBDAAI1g3QCAQEKXMGwAaoAJgJGCWPJjYUK5pwBhE0oEQRUAgikYmQRACHA4ATk4lAA0BODSFFARkgMeiYnQAIAFHgGAUJA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fc703030381c00ff
Perceptual Hash:ce47b118cd2bb907
Difference Hash:516165616131696b
Wavelet Hash:fdf03030381c38ff
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data