Security Report: foccuseditora.com.br - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/08e19069-c88a-4f76-81b2-c2869d75b50a Domain and IP registration (RDAP)/api/v1/rdap/08e19069-c88a-4f76-81b2-c2869d75b50a Certificate Transparency/api/v1/ct/foccuseditora.com.br How often this domain was scanned/api/v1/domain/stats/foccuseditora.com.br Scan history for this domain/api/v1/domain/history/foccuseditora.com.br?limit=15

This website contacted 14 IPs in 2 countries across 10 domains to perform 104 HTTP transactions. The main domain is foccuseditora.com.br and was registered 21 years ago.

Submitted URL: https://foccuseditora.com.br

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Legitimate 3-year-old Brazilian education publisher whose site has been compromised: page HTML carries a roster-anchored IClickFix/EtherHiding ClickFix loader and contacts malware-flagged domains (zvh4.com, sepolia.gateway.tenderly.co). Do not interact.

Risk Factors (5)

ClickFix/EtherHiding malware loader injected into the page for Windows visitors, fetching an AES-encrypted stage from an Ethereum Sepolia smart contract

Multiple CRITICAL YARA malware detections (roster-anchored) on page HTML

7 CRITICAL IDS alerts for ClickFix/EtherHiding domains and exfiltration

Page scripts contact flagged third-party domains zvh4.com (multi-feed malware) and sepolia.gateway.tenderly.co (EtherHiding RPC)

Single-source malware/loader report against the primary domain

Domain age information unavailable

Details

Page Title

Foccus – Editora

Scan Type

public

Favicon Hash

MMH3: 44795047

MD5: 4e08ec7b16eaaa9f59c779c42cc21a66

Domain Name Analysis

The domain name 'foccuseditora.com.br' uses the Brazilian country-code top-level domain (.com.br) while skipping any subdomain. The registrable portion 'foccuseditora' spans 13 characters containing 6 vowels alongside seven consonants. It segments into 4 words: foc, cus, editor, a. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.53s

Total Load Time

11.1 MB

Total Size

Language Analysis

Primary Language

🇵🇹Portuguese

Code: pt

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pt-BR

Text Length:2,315 chars

Detector Agreement:100%

Website Classification

Primary Category

education learning100% confidence

Type: spa

Method: ml+structural

All Detected Categories

education learning

100%

government public service

95%

news media journalism

83%

adult content

56%

news/blog

20%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
13	132.145.135.216Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
7	142.251.110.95Google · CDN	United States	AS15169Google LLC
7	192.178.183.97Google · CDN	United States	AS15169Google LLC
7	56.126.82.66Aws · CLOUD	São Paulo, São Paulo, Brazil	AS16509Amazon.com, Inc.
7	216.239.34.36Google · CDN	United States	AS15169Google LLC
7	104.17.208.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	142.251.110.94Google · CDN	United States	AS15169Google LLC
7	192.0.77.48	San Francisco, California, United States	AS2635Automattic, Inc
7	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
7	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
104	14	-	-