Security Report: gruposanluis.edu.pe - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/0d744b3f-7654-431f-88e5-237ca2098804 Domain and IP registration (RDAP)/api/v1/rdap/0d744b3f-7654-431f-88e5-237ca2098804How often this domain was scanned/api/v1/domain/stats/gruposanluis.edu.pe Scan history for this domain/api/v1/domain/history/gruposanluis.edu.pe?limit=15

This website contacted 11 IPs in 3 countries across 9 domains to perform 87 HTTP transactions. The main domain is gruposanluis.edu.pe.

Submitted URL: https://gruposanluis.edu.pe

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Compromised school site serving a ClickFix fake-Cloudflare 'Human Verification' overlay with an EtherHiding blockchain loader that tells Windows users to paste attacker commands into Terminal. Confirmed malware-distribution kit.

Risk Factors (5)

Fake 'Human Verification' / fake Cloudflare connection-check overlay driving users to open Windows Terminal and paste attacker commands (ClickFix)

Blockchain-based EtherHiding loader retrieving next-stage payload from a Polygon smart contract

Obfuscated scripts concealing connections to threat-intel-flagged hosts (gateway.tenderly.co, 1rpc.io, polygon.drpc.org, rpc-mainnet.matic.quiknode.pro)

Exploit-kit and malware C2/loader indicators from network IDS (CRITICAL EtherHiding, ClickFix, ErrTraffic Beer Cluster)

Injected gambling-spam SEO cloak unrelated to the host site's educational content, indicating site compromise

Domain age information unavailable

Details

Page Title

Grupo Educativo San Luis – Una educación de calidad con valores

Scan Type

public

Favicon Hash

MMH3: 1147005678

MD5: 720d446b06f1eaafadd0acbca6e5a78b

Domain Name Analysis

Within the Peruvian country-code top-level domain (.edu.pe), 'gruposanluis.edu.pe' is registered. The core label 'gruposanluis' covers 12 characters containing 5 vowels alongside 7 consonants. Splitting it apart reveals three words: grupo, san, luis. Median word length comes out to 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

20.38s

Total Load Time

6.2 MB

Total Size

Language Analysis

Primary Language

🇪🇸Spanish

Code: es

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:es

Text Length:7,307 chars

Detector Agreement:50%

Website Classification

Primary Category

gambling betting80% confidence

Type: spa

Method: ml+structural

All Detected Categories

gambling betting

80%

education learning

74%

adult content

61%

technology software

49%

education

45%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
17	162.241.60.214	Vinhedo, São Paulo, Brazil	AS31898Oracle Corporation
7	150.136.141.142Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
7	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
7	192.178.183.95Google · CDN	United States	AS15169Google LLC
7	142.251.14.94Google · CDN	United States	AS15169Google LLC
7	104.26.5.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
7	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
7	142.251.14.95Google · CDN	United States	AS15169Google LLC
7	142.251.110.94Google · CDN	United States	AS15169Google LLC
87	11	-	-