Security Scan Report: afs-fittings.de

Redirected to:
https://afs-fittings.de/#section0
Site favicon
Submitted: Completed: publiccompleted
This website contacted 6 IPs in 2 countries across 5 domains to perform 65 HTTP transactions. The main domain is afs-fittings.de.

Submitted URL: https://afs-fittings.de

Effective URL:
https://afs-fittings.de/#section0
Redirected

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Domain served a legitimate-looking German fittings company page, but carries a content-malware threat-intel hit plus critical ClickFix/EtherHiding IDS alerts and a clearfake-linked third-party domain — consistent with a compromised site deploying a loader.

Risk Factors (5)
Content-malware threat-intel match on the primary domain (afs-fittings.de) — loader designation
Critical IDS malware alerts for ClickFix and EtherHiding exfiltration associated with this page's network traffic
Malicious third-party domain interseq.at (clearfake exploit-kit) corroborated by 3 independent threat feeds
Blockchain RPC domains contacted for payload retrieval (Tenderly, Nodies, 1rpc)
Recently registered domain (31 days) hosting content that claims an established company history since 1984
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain name 'afs-fittings.de' uses the German country-code top-level domain (.de) with no subdomain. Count 12 characters in 'afs-fittings' with 3 vowels and eight consonants, plus one hyphen. Breaking it apart gives three words: a, fs, fittings. Median word length comes out to 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://afs-fittings.de

Page Load Overview

4.09s
Total Load Time
18.1 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:3,447 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical96% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
96%
corporate business
91%
government public service
91%
download file sharing
90%
blog personal website
63%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
15116.203.21.254Nuremberg, Bavaria, Germany
AS24940Hetzner Online GmbH
10104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1035.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
10104.21.3.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
656--

Detected Technologies6

WordPressv7.1.3
100%
JQueryv2.2.2
100%
50%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C80473D3869824CC9B1E9BE6C186EC78EDB3D0AB2D5ED1603AACF1637F115547201E2D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:PFUYyp3cyIyD6uDxGB+x9boRKPNppY3oZe09NppY3oZe09NppY3oZe0O2V/9twjz:9U55oymuDxGB+DboEw26tHmX52SNpy

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:185041:HB80AiAHkIF8Asg2GCooUAqXYMIbgoK4AJgRXQUBYQQUCndiUANiIhcSGRMEG4jAStBl0jhiFRguKQVADmAi8ASQbTAGWOAM

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:1e1e1e1c1c3c3c3c
Perceptual Hash:9e34871f3bccc8d0
Difference Hash:747cb4e868616969
Wavelet Hash:1e1e1e3e1c3c3c3c
Color Hash:#ac5393

Other Hashes

Crop Resistant:747cb4e868616969

Scan History

Scan history not available

Unable to load historical scan data