Security Scan Report: monherbo.fr

Redirected to:
https://www.monherbo.fr/
Site favicon
Submitted: Sep 22, 2026, 1:23:18 PMCompleted: Sep 22, 2026, 1:24:00 PMpubliccompleted

This website contacted 14 IPs in 3 countries across 12 domains to perform 67 HTTP transactions. The main domain is monherbo.fr and was registered 11 months ago.

Submitted URL: https://monherbo.fr

Effective URL:

https://www.monherbo.fr/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 82%

9
Risk Score

Established herb-pharmacy site appears compromised: clipboard pastejacking staged a Windows shell command downloading app.exe from s2.2083.to (ClickFix malware lure). Do not paste anything; avoid.

Risk Factors
Clipboard shell-injection (pastejacking) payload staged on the site
Windows shell command downloading app.exe from s2.2083.to
Unexpected out-of-band domain (oob.tecnomar63.us) in loaded resources
Likely compromised legitimate site repurposed for malware delivery
Domain age information unavailable

Details

Page Title

MONHERBO.FR -Herboristerie depuis 1942 - Nantes - phytotherapie - gemmotherapie - aromatherapie - plante en vrac - EPS

Scan Type

public

Domain Name Analysis

You're looking at domain 'monherbo.fr' on the French country-code top-level domain (.fr) with no subdomain. Count 8 characters in 'monherbo' containing three vowels alongside 5 consonants. Breaking it apart gives three words: mon, her, bo. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://monherbo.fr

Page Load Overview

2.81s
Total Load Time
1.8 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:517 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software57% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
57%
documentation technical
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
15213.186.33.87Saran, Centre-Val de Loire, France
AS16276OVH SAS
4172.67.69.29Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
474.125.29.95Google · CDNUnited States
AS15169Google LLC
4146.75.122.217Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
4104.21.79.80Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.26.6.173Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4172.67.169.92Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.110.139Google · CDNUnited States
AS15169Google LLC
4192.178.183.94Google · CDNUnited States
AS15169Google LLC
4142.251.110.101Google · CDNUnited States
AS15169Google LLC
6714--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A9315806C4479D0FE292167A9E85700AC77BD507EB086C88F8DF051C17F2B8C446BD8C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:hGJKBSRKES2V7NbZrpST1lUhl4lisFgRGvggoEINS6ZDt6bWx5oTWjNVG:fSRTS2V7NbyT1WcrFgygg/ITiWxc

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1697:AAFgAAQAAAAAgAAAAAAkAQEBABAAAAAAACABEAAACIAAAAiAJCAAAAggAACCgQAAAAgAAAAAIgACgAAJAAAAAAABAAAASAIC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00000001ffffffff
Perceptual Hash:b94a57b98a8af1c4
Difference Hash:714d0f291712164c
Wavelet Hash:00000000ffffffff
Color Hash:#78763a

Scan History

Scan history not available

Unable to load historical scan data