Security Scan Report: muziekvereniging-excelsior.nl

Redirected to:
https://www.muziekvereniging-excelsior.nl/
Site favicon
Submitted: Sep 22, 2026, 6:47:28 AMCompleted: Sep 22, 2026, 6:48:28 AMpubliccompleted

This website contacted 24 IPs in 3 countries across 21 domains to perform 95 HTTP transactions. The main domain is muziekvereniging-excelsior.nl and was registered 18 years ago.

Submitted URL: https://muziekvereniging-excelsior.nl

Effective URL:

https://www.muziekvereniging-excelsior.nl/
Redirected

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Legitimate-looking 14-year-old Dutch music association site, but its traffic shows a CRITICAL EtherHiding malware IDS alert and it loads the multi-source malware domain qaz0.com plus a blockchain RPC — strongly indicating a compromised site injecting malware.

Risk Factors (4)
Critical IDS malware/trojan alert (EtherHiding Exfil) on page network traffic
Malicious external resource qaz0.com loaded by the page (multi-source malware IoC)
Blockchain RPC endpoint loaded externally, matching the EtherHiding malware-delivery pattern
Indicators of Compromise match on the primary domain (malware/RAT, single-source)
Domain age information unavailable

Details

Page Title

Muziekvereniging Excelsior | Site van Muziekvereniging Excelsior Ellecom-De Steeg

Scan Type

public

Domain Name Analysis

Within the Dutch country-code top-level domain (.nl), 'muziekvereniging-excelsior.nl' is registered with no subdomain. Count 26 characters in 'muziekvereniging-excelsior' containing 11 vowels alongside 14 consonants, along with 1 hyphen. It segments into 5 words: m, uzi, ek, vereniging, excelsior. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://muziekvereniging-excelsior.nl

Page Load Overview

17.28s
Total Load Time
2.1 MB
Total Size

Language Analysis

Primary Language

🇳🇱Dutch
Code: nl
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:nl-NL
Text Length:2,369 chars
Detector Agreement:75%

Website Classification

Primary Category

corporate50% confidence
Type: spa
Method: structural

All Detected Categories

corporate
50%
news/blog
40%

Detected Features

Search
Articles
OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2646.235.40.85Netherlands
AS213192NetBase BV
3142.251.13.97Google · CDNUnited States
AS15169Google LLC
3142.250.154.95Google · CDNUnited States
AS15169Google LLC
3192.0.76.3San Francisco, California, United States
AS2635Automattic, Inc
3157.240.0.6Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
3192.178.183.97Google · CDNUnited States
AS15169Google LLC
3142.251.110.95Google · CDNUnited States
AS15169Google LLC
3104.26.4.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3216.239.34.36Google · CDNUnited States
AS15169Google LLC
3188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9524--

Detected Technologies12

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14C032AB1E2CC10933E1E4B6DE6B0B26C925CA6319906BB7BF4E8315C59545FF00A7E1E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:dCsdUqQm0PIlGDzHz8CMe9ihpkCt3neClSgdV0RCddNJ6Ih7a472ZdSZUaAh7kWT:dCsmqQmsSGDjAxkCleYd2RCdqZdypaZT

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:37846:AJwRkMUGQVZYaQ8YDyD2A6EcgKdCPKECHQhEEkKGkSBRACn0iCM2SCusGnAAAAbgiMi1EAhWAAEwKyKDDdCssMZOMRpA4Ccy

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data