Security Report: prefirobh.com.br - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/1b28d1fc-3cd9-4742-86ee-4f6039f5aaf2 Domain and IP registration (RDAP)/api/v1/rdap/1b28d1fc-3cd9-4742-86ee-4f6039f5aaf2How often this domain was scanned/api/v1/domain/stats/prefirobh.com.br Scan history for this domain/api/v1/domain/history/prefirobh.com.br?limit=15

This website contacted 31 IPs in 3 countries across 27 domains to perform 181 HTTP transactions. The main domain is prefirobh.com.br and was registered 2 years 2 months ago.

Submitted URL: https://prefirobh.com.br/

AI Security Verdict

High Risk

Confidence: 92%

Risk Score

Legitimate-looking BH travel blog that has been compromised with an injected EtherHiding ClickFix kit: an obfuscated script pulls a 'Human Verification' overlay from a smart contract and pushes Windows visitors to run Terminal commands. Indicators of Compromise on the primary domain and loaded hosts corroborate malware distribution; do not visit.

Risk Factors (5)

Injected ClickFix-style fake 'Human Verification' overlay instructing Windows users to open Terminal and run commands (kit roster CRITICAL, YARA match) — leads to malware/downloader execution on the visitor's machine

EtherHiding blockchain-based payload retrieval (critical IDS 'ET MALWARE EtherHiding Exfil M2', Ethereum getDomain() contract requests, Polygon RPC lookups)

Obfuscated inline script concealing threat-feed hosts (1rpc.io, polygon.gateway.tenderly.co) — decoded only after deobfuscation

Content-malware Indicators of Compromise on the primary domain and URL across two independent feeds, plus a multi-feed malicious third-party domain (cloud-browse.codes) loaded by the page

Site appears compromised: legitimate travel content serving an injected malicious overlay to visitors

Domain age information unavailable

Details

Page Title

Prefiro BH - Um Guia Bão Demais Sô

Scan Type

public

Favicon Hash

MMH3: -1030763746

MD5: b753fdfd2ce91aa56c8d5d1c4f212c6a

Domain Name Analysis

Domain 'prefirobh.com.br' uses the Brazilian country-code top-level domain (.com.br) while skipping any subdomain. The second-level label 'prefirobh' is 9 characters long holding three vowels versus six consonants. Splitting it apart reveals four words: pref, i, rob, h. Median word length comes out to 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.66s

Total Load Time

4.1 MB

Total Size

Language Analysis

Primary Language

🇵🇹Portuguese

Code: pt

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pt-BR

Text Length:9,040 chars

Detector Agreement:100%

Website Classification

Primary Category

corporate70% confidence

Type: spa

Method: structural

All Detected Categories

corporate

70%

news/blog

40%

Detected Features

Articles

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
31	104.21.77.76Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	104.16.80.73Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	172.67.205.98Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	104.16.79.73Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	142.251.20.97Google · CDN	United States	AS15169Google LLC
5	142.251.110.157Google · CDN	United States	AS15169Google LLC
5	142.251.110.154Google · CDN	United States	AS15169Google LLC
5	142.251.13.95Google · CDN	United States	AS15169Google LLC
5	104.18.10.219Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	104.26.4.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
181	31	-	-