Security Scan Report: monocafe.com.pl

Site favicon
Submitted: Sep 17, 2026, 7:47:28 AMCompleted: Sep 17, 2026, 7:48:18 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Compromised Polish cafe site now serving exploit-kit and EtherHiding malware C2 (15 CRITICAL IDS alerts) plus injected casino SEO spam; Safe Browsing unwanted-software hit.

Risk Factors
Operational exploit-kit (ErrTraffic) activity detected by IDS
Malware exfiltration via EtherHiding (blockchain smart-contract C2) detected by IDS
Google Safe Browsing 'Unwanted Software' threat
Primary domain flagged as malware (iclickfix) in threat intel
Injected casino/gambling SEO spam across Polish, Italian, Azerbaijani, French and Dutch text
Dynamic code execution: eval() and 28 Function() constructor calls
Multiple malicious external domains loaded as sub-resources
Domain age information unavailable

Details

Page Title

Mono Cafe & Bistro – Odwiedź nas w łódzkim Monopolis!

Scan Type

public

Domain Name Analysis

You're looking at domain 'monocafe.com.pl' on the Polish country-code top-level domain (.com.pl) with no subdomain. The registrable portion 'monocafe' spans 8 characters split between 4 vowels and four consonants. Word splitting yields two words: mono, cafe. Median word length is 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://monocafe.com.pl

Page Load Overview

5.22s
Total Load Time
1023 KB
Total Size

Language Analysis

Primary Language

🇵🇱Polish
Code: pl
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:pl-PL
Text Length:26,737 chars
Detector Agreement:67%

Website Classification

Primary Category

news/blog40% confidence
Type: spa
Method: structural

All Detected Categories

news/blog
40%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3172.67.196.21Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.13.95Google · CDNUnited States
AS15169Google LLC
3178.236.255.241Amsterdam, North Holland, Netherlands
AS210644Aeza Group LLC
3142.251.110.97Google · CDNUnited States
AS15169Google LLC
3104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.21.84.188Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.110.95Google · CDNUnited States
AS15169Google LLC
3192.178.183.97Google · CDNUnited States
AS15169Google LLC
3172.66.164.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
6622--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T108334BB03652D660965F32D3A887FC67C2F868F409AACF487C7D9C054E9CD7462582EB

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:kxiP2xiP2xiP2xiP2xiP2xiP2xiP2xiP2xiPUxiP2xiP2xiP2xiP2xiPt0Z:Nffffffff9ffff+

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:51006:gEilBJcOQbgugLhsBFgHgkhkWUKDBT2CEAoCBIDHozAIIFSEScChRKNgMAAqwUaaTVURwpB6AACASg0sHIJ41ABxWQi4DhTA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe7e7ffffff
Perceptual Hash:e699993666c99932
Difference Hash:0000000c0c000000
Wavelet Hash:ccccfce4243c3030
Color Hash:#5f3a78

Other Hashes

Crop Resistant:0000000c0c000000

Scan History

Scan history not available

Unable to load historical scan data