Security Report: www.bluebuttonshop.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/298c813d-f62d-44f0-9870-30975febf229 Domain and IP registration (RDAP)/api/v1/rdap/298c813d-f62d-44f0-9870-30975febf229How often this domain was scanned/api/v1/domain/stats/bluebuttonshop.com Scan history for this domain/api/v1/domain/history/bluebuttonshop.com?limit=15

This website contacted 25 IPs in 3 countries across 18 domains to perform 80 HTTP transactions. The main domain is bluebuttonshop.com and was registered 13 years ago.

Submitted URL: https://www.bluebuttonshop.com/

AI Security Verdict

High Risk

Confidence: 87%

Risk Score

Legitimate 13-year-old Toronto fashion retailer whose site appears compromised: obfuscated EtherHiding script loads a next stage from a blockchain contract and exfiltrates via a trycloudflare tunnel, confirming CRITICAL IDS malware alerts.

Risk Factors (5)

Obfuscated JavaScript performing EtherHiding (blockchain-hosted next stage) — a known GhostAdmin/SocGholish-style compromise technique

CRITICAL IDS malware/exfiltration alerts on a page that otherwise contains no dynamic content

Hidden threat-feed host (sepolia.gateway.tenderly.co) reachable only after decoding the script

Traffic funneled through an unranked trycloudflare.com tunnel contacted by page scripts

Blockchain RPC connections from a fashion retail page, which has no legitimate business need for them

Domain age information unavailable

Details

Page Title

Blue Button Shop | Japanese Fashion for Men and Women

Scan Type

public

Favicon Hash

MMH3: 1529192816

MD5: c47353824bb21c8e268a16c18d3b6d16

Domain Name Analysis

You're looking at domain 'www.bluebuttonshop.com' on the commercial generic top-level domain (.com); it also runs on subdomain 'www'. Its registrable label 'bluebuttonshop' stretches across 14 characters containing five vowels alongside nine consonants. Word splitting yields 3 words: blue, button, shop. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

Introducing ipping on ord ur US customers: tariff 0 (@) BLUE BUTTON SHOP Q 4 MEN WOMEN LIFESTYLE = EYEWEAR EDITORIAL best shopping experience to our custo s on a lected data will not be used or sh...

Page Load Overview

27.47s

Total Load Time

5.6 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:59%

Script:Latin

Direction:ltr

Detection Details

Text Length:5,280 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical51% confidence

Type: spa

Method: ml+structural

All Detected Categories

documentation technical

51%

entertainment media

50%

adult content

38%

corporate

25%

forum

20%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	173.209.39.80	Canada	AS36666GloboTech Communications
3	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	142.251.20.95Google · CDN	United States	AS15169Google LLC
3	104.17.25.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	192.178.183.95Google · CDN	United States	AS15169Google LLC
3	142.251.110.97Google · CDN	United States	AS15169Google LLC
3	162.159.128.61Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	216.239.38.178Google · CDN	United States	AS15169Google LLC
3	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
3	23.48.23.43Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
80	25	-	-