Security Report: parez-heliumballon.de - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/4841b998-bae2-465e-be30-bc163712bea0 Domain and IP registration (RDAP)/api/v1/rdap/4841b998-bae2-465e-be30-bc163712bea0 Certificate Transparency/api/v1/ct/parez-heliumballon.de How often this domain was scanned/api/v1/domain/stats/parez-heliumballon.de Scan history for this domain/api/v1/domain/history/parez-heliumballon.de?limit=15

This website contacted 6 IPs in 2 countries across 6 domains to perform 39 HTTP transactions. The main domain is parez-heliumballon.de and was registered 3 months ago.

Submitted URL: https://parez-heliumballon.de/

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Page content is a legitimate-looking Düsseldorf kiosk site, but analyst-vetted kit-roster and CRITICAL IDS alerts show it is compromised and serving the DarkSword iOS exploit kit / Coruna wallet stealer. Avoid entirely; do not load on iOS devices.

Risk Factors (5)

Known malicious exploit kit identified by analyst-vetted kit roster (DarkSword iOS exploit chain / Coruna wallet stealer)

CRITICAL network IDS alerts for exploit-kit landing, RCE loader and RCE module pages

Threat-intelligence matches (6) for malware-typed domains loaded by the page (apiforxwork.com/.net, translatevv.com, js.* subdomains)

POST traffic and DNS/TLS resolution to suspicious .icu domains plus external IP-check callbacks (victim fingerprinting)

Hidden exploit iframe behind a fake 'security verification' captcha gate (per kit roster)

Domain age information unavailable

Details

Page Title

Parez Heliumballon - Heliumballons in Düsseldorf

Scan Type

public

Favicon Hash

MMH3: 1206200437

MD5: 3e421dabc5adb6769c832c4a57ae643e

Domain Name Analysis

The domain 'parez-heliumballon.de' uses the German country-code top-level domain (.de) without a subdomain. The second-level label 'parez-heliumballon' is 18 characters long split between 7 vowels and 10 consonants, plus one hyphen. Word splitting yields four words: pa, rez, helium, ballon. The median word length lands at 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

5.78s

Total Load Time

21.8 MB

Total Size

Language Analysis

Primary Language

🇩🇪German

Code: de

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:de

Text Length:1,143 chars

Detector Agreement:50%

Website Classification

Primary Category

government public service83% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

government public service

83%

finance banking

76%

e-commerce shopping

65%

adult content

38%

healthcare medical

32%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
9	217.160.0.233	Germany	AS8560IONOS SE
6	104.21.32.211Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	172.67.187.123Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	104.16.185.241Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
39	6	-	-