Security Report: vormix.nl - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3de2bec9-d63d-4c33-ba64-5b518bcb1b1c Domain and IP registration (RDAP)/api/v1/rdap/3de2bec9-d63d-4c33-ba64-5b518bcb1b1c Certificate Transparency/api/v1/ct/vormix.nl How often this domain was scanned/api/v1/domain/stats/vormix.nl Scan history for this domain/api/v1/domain/history/vormix.nl?limit=15

This website contacted 5 IPs in 2 countries across 6 domains to perform 75 HTTP transactions. The main domain is vormix.nl and was registered 1 month ago.

Submitted URL: https://vormix.nl

Effective URL:

https://www.vormix.nl/

Redirected

AI Security Verdict

High Risk

Confidence: 92%

Risk Score

Legitimate Dutch design bureau's site appears compromised: an IClickFix ClickFix injection with an EtherHiding blockchain loader is served to visitors, confirmed by kit-roster YARA, CRITICAL IDS alerts and threat intel.

Risk Factors (5)

Known malicious ClickFix/IClickFix injection present in the page's HTML/JavaScript

EtherHiding loader using blockchain smart-contract-hosted payload with blockchain RPC/C2 domains contacted from the browser

Multiple CRITICAL network IDS alerts for malware C2/exfiltration

Third-party malicious resource (zvh3[.]com) corroborated by two independent threat-intel feeds

Obfuscated scripts concealing threat-feed hosts (anti-analysis behavior)

Domain age information unavailable

Details

Page Title

Home | Vormix

Scan Type

public

Favicon Hash

MMH3: 967923094

MD5: 67f5552febee6d14765511402f85ba63

Domain Name Analysis

You're looking at domain 'vormix.nl' on the Dutch country-code top-level domain (.nl). The second-level label 'vormix' is 6 characters long containing 2 vowels alongside four consonants. Tokenizing the label suggests 2 words: vor, mix. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.96s

Total Load Time

3.8 MB

Total Size

Language Analysis

Primary Language

🇳🇱Dutch

Code: nl

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:nl

Text Length:1,336 chars

Detector Agreement:100%

Website Classification

Primary Category

corporate business36% confidence

Type: spa

Method: ml+structural

All Detected Categories

corporate business

36%

healthcare medical

34%

government public service

32%

corporate

25%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
15	83.217.75.215	Belgium	AS34762Combell NV
15	74.125.29.95Google · CDN	United States	AS15169Google LLC
15	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
15	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
15	104.21.72.64Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
75	5	-	-