Security Scan: Afforest International

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/18cfe3ae-b31c-432f-8559-c903abeaf6d1 Domain and IP registration (RDAP)/api/v1/rdap/18cfe3ae-b31c-432f-8559-c903abeaf6d1 Certificate Transparency/api/v1/ct/afforestintl.com How often this domain was scanned/api/v1/domain/stats/afforestintl.com Scan history for this domain/api/v1/domain/history/afforestintl.com?limit=15

This website contacted 8 IPs in 3 countries across 8 domains to perform 51 HTTP transactions. The main domain is afforestintl.com and was registered 18 years ago.

Submitted URL: https://afforestintl.com

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Legitimate-looking afforestintl.com is compromised and serves a ClickFix/EtherHiding kit: a fake Cloudflare 'Human Verification' overlay that instructs Windows users to paste Terminal commands, confirmed by roster-anchored CRITICAL YARA and IDS malware alerts and a malware IoC on the primary domain.

Risk Factors (8)

Fake Cloudflare 'Human Verification' / 'I'm not a robot' overlay impersonating Cloudflare's challenge UI on a non-Cloudflare-verification domain

Instructions to open Windows Terminal and paste-and-Enter commands (ClickFix / Win+X technique) to execute attacker-supplied code

EtherHiding: obfuscated script resolves its next-stage payload address from a Polygon smart contract and loads the overlay from it

Threat-feed hosts (1rpc.io, polygon.drpc.org, polygon.gateway.tenderly.co) hidden inside an obfuscated script and only visible after decoding

Cross-origin POST beacon to unranked ferma.seo-solutions.eu.cc with host/uri parameters (tracking/injection callback)

Primary domain afforestintl.com matched by two independent threat feeds as clearfake malware

Obfuscated third-party script host browse-codes-enter.beer served JavaScript to the page (unranked, unrelated to the site's business)

Spam text injected into the page content ('casino utan svensk licens') unrelated to the site's stated business

Domain age information unavailable

Details

Page Title

Afforest International

Scan Type

public

Favicon Hash

MMH3: -1449281872

MD5: 725c8608ee621f192efb8eea95db3e6d

Domain Name Analysis

Domain 'afforestintl.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. The core label 'afforestintl' covers 12 characters with four vowels and eight consonants. Breaking it apart gives three words: afforest, in, tl. Median word length comes out to 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

6.31s

Total Load Time

2.3 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:3,009 chars

Detector Agreement:75%

Website Classification

Primary Category

corporate business69% confidence

Type: spa

Method: ml+structural

All Detected Categories

corporate business

69%

adult content

57%

finance banking

44%

gambling betting

43%

phishing scam

40%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
9	65.21.198.89	Helsinki, Uusimaa, Finland	AS24940Hetzner Online GmbH
6	142.251.110.95Google · CDN	United States	AS15169Google LLC
6	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
6	104.21.58.227Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	192.178.183.94Google · CDN	United States	AS15169Google LLC
6	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
6	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
51	8	-	-