Kexart.com Review: Suspicious Website

The public root page returned an art-portfolio interface over HTTPS, but several visible trust and contact controls were placeholders rather than working destinations.

• HTTP status 200
• Final URL https://kexart.com/
• Page element The page contained eight fragment-only href=# controls: six Instagram, Twitter, and LinkedIn icons plus Privacy Policy and Terms of Service links.
• File SHA-256 38526791e58c90cf496d600cd39671698e4063d84342f72c9cbe2355948f7b77

The visible contact form had no submission destination, and its Send Message control did not implement message delivery.

• Page element The form element had no action attribute.
• Page element The Send Message control was type=button and its component-level click handler only called preventDefault().
• Analyst observation A separate document-level capture-phase click handler intercepted the button interaction before the form component could provide normal behavior.

The site's shipped client script intentionally converted ordinary button and link clicks outside the navigation area into a disruptive full-page interaction trap.

• File SHA-256 722f065406951f1d84021f125850c9e8d807953323ef6578f9193bbd8330fa8a
• Page element The capture-phase handler matched BUTTON, A, role=button, and cursor-pointer targets outside nav, header, and menu elements.
• Analyst observation The triggered routine requested fullscreen, added a full-viewport pointer-blocking overlay, applied rapidly cycling RGB and inversion animations, and displayed CHUCHE PVT LIMITED attribution text.
• Screenshot SHA-256 61ecf506ad4c98bbcf98224d60cade3df0bf330975b638584439e71fed2dce55

The client script interfered with leaving the page and repeatedly attempted to re-enter disruptive states after user interaction.

• Page element The script registered a beforeunload handler that set returnValue and caused the browser to display a leave-page confirmation.
• Page element After activation, fullscreen requests were scheduled by a one-millisecond interval and were also attached to click, keydown, touchstart, and scroll events.
• Analyst observation Visibility and focus handlers attempted to resume audio playback when the page became visible or regained focus.

The activated routine contained deliberate browser resource-consumption logic unrelated to the stated art-portfolio function.

• Page element The script started repeated busy loops, recursive Fibonacci and prime-number calculations, large array allocation and sorting, repeated string processing, canvas drawing, and short-lived DOM-node creation.
• Page element One animation loop created 50 full-page elements per frame for up to five seconds and included a 100000-iteration empty loop on each frame.
• Page element The audio routine created four looping players for /prankaudio.mp3 and applied Web Audio gain value 3 when supported.

The referenced same-site prank asset was a short MP3 audio file; no specific executable, malware payload, credential submission, unrelated redirect, or data-exfiltration endpoint was identified in the reviewed public code and HTTP scope.

• HTTP status 200
• MIME type audio/mpeg
• File SHA-256 28f3cd298d00acbef886d0b3284285fa9b1383d74c629d782b843e8fdeb8ce12
• Analyst observation The 52695-byte audio asset was approximately 3.158 seconds long and was configured to loop.
• Analyst observation No specific malicious file, payload, URL, or hash was identified in the reviewed public scope.

The domain used Cloudflare-hosted addresses and presented a currently valid certificate for kexart.com; these infrastructure facts did not mitigate the observed client-side behavior.

• DNS fact The reviewed DNS response used Cloudflare anycast A and AAAA addresses, with authoritative nameservers under cloudflare.com.
• Certificate fact Google Trust Services WE1 certificate for kexart.com, valid from 2026-06-18 through 2026-09-16.