Security Scan Report: romybroeders.nl

Site favicon
Submitted: Completed: publiccompleted
This website contacted 7 IPs in 3 countries across 6 domains to perform 26 HTTP transactions. The main domain is romybroeders.nl and was registered 14 years ago.

Submitted URL: https://romybroeders.nl

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Compromised 14-year-old site now serving a ClickFix fake Cloudflare 'Human Verification' overlay (YARA-verified) that lures Windows users into pasting malware-laden commands into Terminal. Do not interact.

Risk Factors (5)
Injected ClickFix 'Human Verification' social-engineering overlay that walks visitors through pasting a command into Windows Terminal (malware execution lure)
Impersonation of Cloudflare's connection-security / bot-verification page on a domain that is not Cloudflare's
Primary domain flagged as a malware loader in threat intelligence
Loaded third-party host checkyoubrowse.codes flagged as malicious by 2 independent feeds
Blockchain RPC calls (polygon.gateway.tenderly.co, polygon-public.nodies.app) tied to a ClickFix/C2 domain reported in CRITICAL IDS alerts
Domain age information unavailable

Details

Page Title

romy broeders

Scan Type

public

Domain Name Analysis

The domain name 'romybroeders.nl' uses the Dutch country-code top-level domain (.nl) and has no subdomain. The core label 'romybroeders' covers 12 characters with four vowels and eight consonants. Segmentation suggests four words: romy, bro, eder, s. Median word length is 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://romybroeders.nl

Page Load Overview

2.39s
Total Load Time
773 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:779 chars
Detector Agreement:67%

Website Classification

Primary Category

technology software42% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
42%
cryptocurrency blockchain
40%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
885.10.159.61Netherlands
AS34762Combell NV
3142.250.154.95Google · CDNUnited States
AS15169Google LLC
3142.251.14.94Google · CDNUnited States
AS15169Google LLC
3104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
335.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
3178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
3172.67.70.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
267--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14B33F833A31E0417A21A066FA290761855DADE27C50E567C73F726FCEEDCAA941F270C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:x0yplTR1rcrVXjcvCd2MO+RceCDwli+tfVTMed:xld1rcBXjcLX+hM6

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:54381:ECQYLiwBQqQqgIykYdBABFXCABACwROAQiJAdhCRhiqkgBEMm3EeElCAomwADYo2ASooa1mZA+V0NFxRhqQJ1AIcQ4KwgAiA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc3c3c3c3c3ffff
Perceptual Hash:ec6c9b33309e9331
Difference Hash:22b6b68696960016
Wavelet Hash:81c30000c3c3cfcf
Color Hash:#6640bf

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data