ScanMalware.com

Security Scan Report: architekt-hoelzle.de

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/30364d49-fa34-4a75-b39f-c6a224d3eb4fDomain and IP registration (RDAP)/api/v1/rdap/30364d49-fa34-4a75-b39f-c6a224d3eb4fHow often this domain was scanned/api/v1/domain/stats/architekt-hoelzle.deScan history for this domain/api/v1/domain/history/architekt-hoelzle.de?limit=15
This website contacted 5 IPs in 3 countries across 5 domains to perform 142 HTTP transactions. The main domain is architekt-hoelzle.de and was registered 7 years ago.

Submitted URL: https://architekt-hoelzle.de

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Legitimate architecture firm's WordPress site is compromised and serves an ErrTraffic/Exvicy ClickFix loader with EtherHiding blockchain staging. Do not follow any on-screen verification instructions.

Risk Factors (5)
Compromised WordPress installation serving an injected ErrTraffic/Exvicy loader
Blockchain-based next-stage retrieval (EtherHiding) evading static blocking
Deceptive Cloudflare-styled ClickFix prompt coaxing visitors to run commands in a terminal
Obfuscated Base64/XOR-decoded payload executed via new Function
Primary domain architekt-hoelzle.de matched as 'iclickfix (malware)' in threat intelligence
Domain age information unavailable

Details

Page Title

Architekturbüro Hölzle

Scan Type

public

Domain Name Analysis

You're looking at domain 'architekt-hoelzle.de' on the German country-code top-level domain (.de) without a subdomain. The core label 'architekt-hoelzle' covers 17 characters with 6 vowels and ten consonants; it also includes 1 hyphen. Tokenizing the label suggests 7 words: arch, it, ek, t, ho, elz, le. Expect 2 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://architekt-hoelzle.de

Page Load Overview

10.21s
Total Load Time
81.2 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:1,564 chars
Detector Agreement:100%

Website Classification

Primary Category

news/blog40% confidence
Type: spa
Method: structural

All Detected Categories

news/blog
40%

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
30217.160.0.158Germany
AS8560IONOS SE
28142.251.20.95Google · CDNUnited States
AS15169Google LLC
2835.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
28142.250.154.94Google · CDNUnited States
AS15169Google LLC
2831.77.16.64Amsterdam, North Holland, Netherlands
AS219337Fzco
1425--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14C14A433AD876085516397D660142F2CA466D017CB56F0ECB3A9C2FCEFD6E932653B28

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:VSKvXYcKOHjqNzNWNc84i1j8Q/TsweT0Oh0ivaozheEeuYS9/u7cWur8VqMEDIct:V9PA84i1j8Q/TsweTfsMp

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:192358:CpzJoIOCk4xomSgp8JGjgwoDIChBRVqsEAIEACQRpYXFYsAKAAShKIqLJAWAEVHAAQ0DZgEYFBE4kUAPJTYhUTNREuYDR0dX

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7c7c3c3ffffffff
Perceptual Hash:b03032c7cecccdcd
Difference Hash:0c1c163600000008
Wavelet Hash:ffc7c3c33030fc00
Color Hash:#aed22d

Other Hashes

Crop Resistant:0c1c163600000008

Scan History

Scan history not available

Unable to load historical scan data