Security Report: comprojoiasrj.com.br - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/497b645b-b1c9-4b97-9595-579ed8e8dec1 Domain and IP registration (RDAP)/api/v1/rdap/497b645b-b1c9-4b97-9595-579ed8e8dec1 Certificate Transparency/api/v1/ct/comprojoiasrj.com.br How often this domain was scanned/api/v1/domain/stats/comprojoiasrj.com.br Scan history for this domain/api/v1/domain/history/comprojoiasrj.com.br?limit=15

This website contacted 15 IPs in 4 countries across 13 domains to perform 40 HTTP transactions. The main domain is comprojoiasrj.com.br and was registered 6 months ago.

Submitted URL: https://comprojoiasrj.com.br

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Legitimate-looking jewellery site (Lindolfo Joias) is compromised and serving the ClearFake EtherHiding loader plus hidden iclickfix tracker hosts; primary domain flagged as ClearFake malware by two feeds. Do not visit or run its scripts.

Risk Factors (6)

Known ClearFake compromise kit injected into the page (EtherHiding Polygon contract loader + rival-kit cleanup overlay that blocks navigation)

Content-malware Indicator of Compromise on the primary domain (ClearFake) corroborated by two independent threat feeds

Obfuscated script concealing malware C2/redirection hosts (campaigntracker.icu/.run/.top, iclickfix)

Site content hijacked: a jewellery homepage now serves unrelated multilingual casino/health/SEO spam articles linking odd third-party domains

Unranked third-party script host trackerredirect.online (iclickfix malware) contacted cross-origin by page scripts

Scanner-vs-client content mismatch (bot-protection/block page for the datacenter scanner, real ClearFake-laced content for residential visitors), consistent with evasive code running only for real visitors

Domain age information unavailable

Details

Page Title

Lindolfo Joias – Adding Care to your Property

Scan Type

public

Domain Name Analysis

The domain name 'comprojoiasrj.com.br' uses the Brazilian country-code top-level domain (.com.br). The registrable portion 'comprojoiasrj' spans 13 characters holding five vowels versus eight consonants. Word splitting yields five words: comp, rojo, i, as, rj. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.64s

Total Load Time

3.2 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:57%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pt-PT

Text Length:34,242 chars

Detector Agreement:50%

Language mismatch: Declared as pt-PT but detected as en

Website Classification

Primary Category

cryptocurrency blockchain82% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

cryptocurrency blockchain

82%

news/blog

20%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
12	216.172.172.253	Vinhedo, São Paulo, Brazil	AS31898Oracle Corporation
2	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.13.95Google · CDN	United States	AS15169Google LLC
2	185.92.183.208	Riga, Riga, Latvia	AS56971Cgi Global Limited
2	192.178.183.94Google · CDN	United States	AS15169Google LLC
2	157.240.0.35Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
2	142.251.127.84Google · CDN	United States	AS15169Google LLC
2	13.33.52.208Cloudfront · CDN	New York, New York, United States	AS16509Amazon.com, Inc.
2	192.0.77.48	San Francisco, California, United States	AS2635Automattic, Inc
2	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
40	15	-	-