ScanMalware.com

Security Scan Report: iptext.de

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3642bcdb-83b3-4c5e-9fb2-eac40694394dDomain and IP registration (RDAP)/api/v1/rdap/3642bcdb-83b3-4c5e-9fb2-eac40694394dHow often this domain was scanned/api/v1/domain/stats/iptext.deScan history for this domain/api/v1/domain/history/iptext.de?limit=15
This website contacted 3 IPs in 2 countries across 3 domains to perform 103 HTTP transactions. The main domain is iptext.de and was registered 11 years ago.

Submitted URL: https://iptext.de

AI Security Verdict

Confirmed Scam

Confidence: 94%

9
Risk Score

Legitimate German food-wholesale site that has been compromised to serve an IClickFix/EtherHiding malware loader; critical IDS malware alert and analyst-vetted kit match. Do not browse.

Risk Factors (6)
Compromised site injecting an EtherHiding / ClickFix malware loader (IClickFix family) into visitor browsers
Obfuscated JavaScript that fetches its next stage from a blockchain smart contract
Decoded script hides threat-feed-listed RPC/relay hosts (0xrpc.io, 1rpc.io, gateway.tenderly.co)
Critical network IDS detection of EtherHiding exfiltration traffic
Primary domain flagged as a malware loader by two independent threat-intelligence feeds
Third-party resource zvh3.com flagged as an exploit-kit payload by three feeds
Domain age information unavailable

Details

Page Title

IPTEXT Home - IPTEXT Gastronomie Grosshandel GmbH

Scan Type

public

Domain Name Analysis

Within the German country-code top-level domain (.de), 'iptext.de' is registered with no subdomain. The second-level label 'iptext' is 6 characters long with 2 vowels and 4 consonants. Word splitting yields two words: ip, text. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://iptext.de

Page Load Overview

4.98s
Total Load Time
2.3 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:4,143 chars
Detector Agreement:60%

Website Classification

Primary Category

government public service63% confidence
Type: spa
Method: ml+structural

All Detected Categories

government public service
63%
blog personal website
55%
cryptocurrency blockchain
44%
finance banking
39%
corporate
35%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3589.58.35.52Nuremberg, Bavaria, Germany
AS197540netcup GmbH
34172.67.70.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
34172.67.175.246Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1033--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T170F393B3A4404023A2671E58D1856E1CB077D685FAC3CBD575A8F2CB72DAEEFC660718

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:+68Bhc/6X4n/dbY+74nXBhbWttkT9sYe/HYIbnmAqT/NxUbGb4iiwtn8Lt9tJTz0:+68BA6X4n/dbYkSm2

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:171478:ABIAoQQgA0YCGAwwxNMcRwxAhIBx0TpICCA6IBYDkvSKBwMQJEQNhIBdoMCHolFLbRgSQQwIGAAAQAIBRAaOBrAa0Igm8YpY

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:000107676f0f0309
Perceptual Hash:b36e4d93d2259236
Difference Hash:95533e8ecd98867b
Wavelet Hash:400107e7ef6f071f
Color Hash:#d2797f

Other Hashes

Crop Resistant:cbcbe0c1c0c0c8c6,d8f2d919585c7253,f1ccb6b28c969a8e,95533e8ecd98867b

Scan History

Scan history not available

Unable to load historical scan data