Security Scan: BulwaR Restauracja

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/21129d76-3104-4842-be9e-2130657a830c Domain and IP registration (RDAP)/api/v1/rdap/21129d76-3104-4842-be9e-2130657a830cHow often this domain was scanned/api/v1/domain/stats/v2.bulwarrestauracja.pl Scan history for this domain/api/v1/domain/history/v2.bulwarrestauracja.pl?limit=15

This website contacted 9 IPs in 4 countries across 6 domains to perform 43 HTTP transactions. The main domain is bulwarrestauracja.pl and was registered 10 years ago.

Submitted URL: https://v2.bulwarrestauracja.pl/

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Legitimate Poznań restaurant site that has been compromised and injected with Macfinger ClickFix / EtherHiding malware: a fake Cloudflare 'Human Verification' overlay pushes Windows users to paste payloads into Terminal. Malware delivery — avoid.

Risk Factors (5)

Compromised WordPress site injected with Macfinger ClickFix AMOS stealer loader and a Windows ClickFix blockchain loader

Fake Cloudflare-style 'Human Verification' overlay instructing Windows users to open Terminal and paste clipboard content (Win+X, Ctrl+V, Enter)

EtherHiding: next-stage payload address resolved from a Polygon smart contract, evading domain takedowns

External malicious resource cloud-browse.codes and threat-feed blockchain RPC hosts hidden in obfuscated script

Primary domain and scanned URL flagged as malware across two independent threat-intel feeds

Domain age information unavailable

Details

Page Title

BulwaR Restauracja

Scan Type

public

Domain Name Analysis

You're looking at domain 'v2.bulwarrestauracja.pl' on the Polish country-code top-level domain (.pl) and includes subdomain 'v2'. Count 17 characters in 'bulwarrestauracja' split between seven vowels and ten consonants. It segments into six words: bul, war, rest, aura, cj, a. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.08s

Total Load Time

1.2 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:49%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pl-PL

Text Length:4,018 chars

Detector Agreement:100%

Language mismatch: Declared as pl-PL but detected as en

Website Classification

Primary Category

technology software41% confidence

Type: spa

Method: ml+structural

All Detected Categories

technology software

41%

real estate property

26%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
11	109.95.159.1	Poland	AS48896dhosting.pl Sp. z o.o.
4	142.251.20.95Google · CDN	United States	AS15169Google LLC
4	171.22.131.23	Cyprus	AS203273NetCrafters OU
4	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	172.66.146.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
4	74.125.29.95Google · CDN	United States	AS15169Google LLC
4	104.26.4.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
43	9	-	-