Security Report: hotelmadonna.com.ar - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/335c1933-c36b-47ec-a909-73e7bd6d981a Domain and IP registration (RDAP)/api/v1/rdap/335c1933-c36b-47ec-a909-73e7bd6d981aHow often this domain was scanned/api/v1/domain/stats/hotelmadonna.com.ar Scan history for this domain/api/v1/domain/history/hotelmadonna.com.ar?limit=15

This website contacted 10 IPs in 3 countries across 8 domains to perform 73 HTTP transactions. The main domain is hotelmadonna.com.ar.

Submitted URL: https://hotelmadonna.com.ar

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Legitimate hotel site compromised and injected with the ClickFix WinX 'Human Verification' phishing kit plus an EtherHiding blockchain loader; CRITICAL YARA, kit-roster and IDS hits confirm active malware distribution.

Risk Factors (8)

Analyst-vetted CRITICAL ClickFix WinX phishing kit identified twice on the page

CRITICAL YARA malware hits on the injected HTML body (overlay + packed contract loader)

EtherHiding: next-stage payload address retrieved from a blockchain smart contract

Obfuscated JavaScript concealing known-attacker hosts (1rpc.io, polygon.drpc.org, polygon.gateway.tenderly.co)

CRITICAL/HIGH network IDS alerts for ClickFix, EtherHiding and exploit-kit activity

Unranked third-party script host browse-codes-enter.beer (.beer TLD) serving code alongside the injected overlay

8 redirects detected (7 cross-domain)

Indicators of Compromise: primary domain hotelmadonna.com.ar reported as an unknown malware loader (single-source, unverified)

Domain age information unavailable

Details

Page Title

Home - Albergue Transitorio Hotel Madonna

Scan Type

public

Domain Name Analysis

Within the Argentine country-code top-level domain (.com.ar), 'hotelmadonna.com.ar' is registered. The second-level label 'hotelmadonna' is 12 characters long split between 5 vowels and 7 consonants. Word splitting yields 2 words: hotel, madonna. The median word length lands at six characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

43.08s

Total Load Time

1.1 MB

Total Size

Language Analysis

Primary Language

🇪🇸Spanish

Code: es

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:es

Text Length:1,055 chars

Detector Agreement:50%

Website Classification

Primary Category

technology software34% confidence

Type: spa

Method: ml+structural

All Detected Categories

technology software

34%

cryptocurrency blockchain

31%

corporate

25%

Detected Features

Articles

Comments

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
10	167.250.5.32	Argentina	AS264649NUT HOST SRL
7	142.251.14.95Google · CDN	United States	AS15169Google LLC
7	185.111.111.158	Frankfurt am Main, Hesse, Germany	AS212238Datacamp Limited
7	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
7	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
7	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
7	142.250.154.94Google · CDN	United States	AS15169Google LLC
7	172.66.164.193Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	192.178.183.94Google · CDN	United States	AS15169Google LLC
73	10	-	-