Security Scan: Maintenance Page

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/4dd2d155-bd9a-4b5e-adcc-ee6a01e1a031 Domain and IP registration (RDAP)/api/v1/rdap/4dd2d155-bd9a-4b5e-adcc-ee6a01e1a031How often this domain was scanned/api/v1/domain/stats/ultimatron-shop.fr Scan history for this domain/api/v1/domain/history/ultimatron-shop.fr?limit=15

This website contacted 20 IPs in 3 countries across 15 domains to perform 88 HTTP transactions. The main domain is ultimatron-shop.fr and was registered 4 years 2 months ago.

Submitted URL: https://ultimatron-shop.fr

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Maintenance page of a likely compromised French shop carrying an IClickFix/EtherHiding loader: obfuscated JS pulls a payload via Ethereum Sepolia, confirmed by analyst-vetted kit roster and CRITICAL IDS malware alerts.

Risk Factors (5)

ClickFix/EtherHiding malware loader injected into the site's HTML, fetching an encrypted second stage from an Ethereum Sepolia smart contract

Obfuscated JavaScript concealing malicious blockchain RPC endpoints (sepolia.gateway.tenderly.co, gateway.tenderly.co)

Critical network IDS malware alerts (ClickFix domain in DNS and TLS SNI, EtherHiding exfiltration)

Primary domain flagged as a malware loader; a further strongly corroborated malicious third-party host (zvh3.com) is loaded

Likely compromised legitimate shop whose visitors are silently exposed to a Windows payload

Domain age information unavailable

Details

Page Title

Maintenance Page

Scan Type

public

Favicon Hash

MMH3: -108412322

MD5: 40c7e1d7d72579564e87d58307c55e8e

Domain Name Analysis

The domain name 'ultimatron-shop.fr' uses the French country-code top-level domain (.fr) with no subdomain. Its registrable label 'ultimatron-shop' stretches across 15 characters split between 5 vowels and 9 consonants; bonus characters include one hyphen. Splitting it apart reveals three words: ultima, tron, shop. Average segment length settles at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Le site est en cours de maintenance Nous effectuons actuellement quelques travaux de maintenance sur notre site Web pour améliorer votre expérience. En attendant, suivez-nous sur les réseaux sociaux...

Page Load Overview

5.44s

Total Load Time

1.1 MB

Total Size

Language Analysis

Primary Language

🇫🇷French

Code: fr

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:fr-FR

Text Length:1,777 chars

Detector Agreement:75%

Website Classification

Primary Category

documentation technical50% confidence

Type: spa

Method: ml+structural

All Detected Categories

documentation technical

50%

corporate

35%

technology software

30%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
12	104.21.48.236Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	142.251.13.95Google · CDN	United States	AS15169Google LLC
4	142.251.110.97Google · CDN	United States	AS15169Google LLC
4	51.91.48.14	France	AS16276OVH SAS
4	216.198.53.3Cloudflare · CDN	United States	AS209242Cloudflare London, LLC
4	142.250.154.94Google · CDN	United States	AS15169Google LLC
4	216.239.32.36Google · CDN	United States	AS15169Google LLC
4	142.251.127.157Google · CDN	United States	AS15169Google LLC
4	143.204.181.83Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
4	172.67.188.91Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
88	20	-	-