Security Report: lendahand.online - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/374f444a-1887-4803-9ca3-aefc3d6bd4f7 Domain and IP registration (RDAP)/api/v1/rdap/374f444a-1887-4803-9ca3-aefc3d6bd4f7How often this domain was scanned/api/v1/domain/stats/lendahand.online Scan history for this domain/api/v1/domain/history/lendahand.online?limit=15

This website contacted 5 IPs in 2 countries across 4 domains to perform 26 HTTP transactions. The main domain is lendahand.online and was registered 6 years ago.

Submitted URL: https://lendahand.online

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Compromised WordPress page actively serving an IClickFix/EtherHiding ClickFix loader: obfuscated script pulls an encrypted stage from an Ethereum Sepolia contract and contacts the malicious ClickFix domain zvh4.com. Do not visit.

Risk Factors (5)

Compromised WordPress site serving a ClickFix/EtherHiding malware injection

Ethereum Sepolia smart-contract dead-drop used to retrieve an encrypted second stage

Obfuscated inline script with hidden blockchain RPC endpoints (0xrpc.io, 1rpc.io, gateway.tenderly.co)

Page loads a third-party domain independently classified as a malicious exploit kit host

Network IDS flagged active malware C2/exfiltration traffic tied to this page load

Domain age information unavailable

Details

Page Title

lendahand – Just another WordPress site

Scan Type

public

Favicon Hash

MMH3: 1198047028

MD5: 000bf649cc8f6bf27cfb04d1bcdcd3c7

Domain Name Analysis

Domain 'lendahand.online' uses the modern generic top-level domain (.online) without a subdomain. The second-level label 'lendahand' is 9 characters long split between three vowels and six consonants. It segments into 3 words: lend, a, hand. The median word length lands at 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

5.15s

Total Load Time

1.1 MB

Total Size

Language Analysis

Primary Language

🇩🇪German

Code: de

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:de-DE

Text Length:59 chars

Detector Agreement:50%

Website Classification

Primary Category

adult content58% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

adult content

58%

news media journalism

41%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
6	81.169.145.77	Germany	AS6724Strato GmbH
5	192.178.183.95Google · CDN	United States	AS15169Google LLC
5	142.251.14.95Google · CDN	United States	AS15169Google LLC
5	172.66.150.162Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
26	5	-	-