Security Scan: Справочник PROFI СПЕЦИАЛИСТЫ И УСЛУГИ В СОФИИ

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/1fcf92d2-6ba7-43c4-a226-82dc92430c51 Domain and IP registration (RDAP)/api/v1/rdap/1fcf92d2-6ba7-43c4-a226-82dc92430c51How often this domain was scanned/api/v1/domain/stats/profi-bg.com Scan history for this domain/api/v1/domain/history/profi-bg.com?limit=15

This website contacted 7 IPs in 3 countries across 7 domains to perform 69 HTTP transactions. The main domain is profi-bg.com and was registered 9 months ago.

Submitted URL: https://profi-bg.com

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Compromised site serving a ClickFix 'Human Verification' EtherHiding loader (roster-anchored CRITICAL YARA + IDS EtherHiding/exploit-kit alerts). Visitors are pushed to run attacker commands. Do not interact.

Risk Factors (5)

Compromised site injecting a ClickFix fake 'Human Verification' overlay that instructs Windows users to run Terminal commands (Win+X workflow)

EtherHiding blockchain-delivered payload loader matching a known malicious kit family

Hidden blockchain RPC domains in obfuscated JavaScript (polygon.drpc.org, 1rpc.io, tenderly.co) used for C2/stage retrieval

Threat-intelligence match on the primary domain itself (unknown loader / malware)

Unranked domain with credential-style login/register forms present on a compromised page

Domain age information unavailable

Details

Page Title

Справочник PROFI СПЕЦИАЛИСТЫ И УСЛУГИ В СОФИИ – Специалисты и Услуги в Софии

Scan Type

public

Favicon Hash

MMH3: 445357117

MD5: e2a33f5d003054d95d14cb0e06a001d4

Domain Name Analysis

Domain 'profi-bg.com' uses the commercial generic top-level domain (.com). The second-level label 'profi-bg' is 8 characters long holding two vowels versus five consonants, plus 1 hyphen. Segmentation suggests 3 words: prof, i, bg. Average segment length settles at 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.99s

Total Load Time

1.1 MB

Total Size

Language Analysis

Primary Language

🇷🇺Russian

Code: ru

Confidence:60%

Script:Cyrillic

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:4,565 chars

Detector Agreement:75%

Language mismatch: Declared as en-US but detected as ru

Website Classification

Primary Category

healthcare medical67% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

67%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
15	135.181.181.90	Helsinki, Uusimaa, Finland	AS24940Hetzner Online GmbH
9	142.251.14.95Google · CDN	United States	AS15169Google LLC
9	142.251.14.94Google · CDN	United States	AS15169Google LLC
9	172.66.146.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
9	104.21.95.226Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	142.250.154.94Google · CDN	United States	AS15169Google LLC
69	7	-	-