Security Report: retro-erp.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/615d1ff7-b172-4318-9203-428b41b3a58a Domain and IP registration (RDAP)/api/v1/rdap/615d1ff7-b172-4318-9203-428b41b3a58aHow often this domain was scanned/api/v1/domain/stats/retro-erp.com Scan history for this domain/api/v1/domain/history/retro-erp.com?limit=15

This website contacted 8 IPs in 4 countries across 9 domains to perform 122 HTTP transactions. The main domain is retro-erp.com and was registered 4 years 1 month ago.

Submitted URL: https://retro-erp.com

AI Security Verdict

High Risk

Confidence: 95%

Risk Score

Legitimate-looking ERP site compromised with a ClearFake EtherHiding loader: hunting rule + kit-roster hit, TA569 Gholoader C2 and EtherHiding IDS alerts. Avoid visiting; site owner should clean the infection.

Risk Factors (5)

ClearFake EtherHiding malware loader injected into the page (hunting rule + kit roster confirmation)

Command-and-control domain billing.roofnrack.us (TA569 Gholoader) contacted per IDS

EtherHiding exfiltration traffic and Polygon RPC usage

Multiple multi-source corroborated malicious third-party domains loaded by the page

No credential or payment form present — this is malware delivery, not credential harvesting

Domain age information unavailable

Details

Page Title

Retrospect – Retrospect

Scan Type

public

Favicon Hash

MMH3: 1337198402

MD5: dd5f2f3a232bf0648dad46b5754f4653

Domain Name Analysis

You're looking at domain 'retro-erp.com' on the commercial generic top-level domain (.com) and has no subdomain. The core label 'retro-erp' covers 9 characters split between 3 vowels and five consonants, notching 1 hyphen. Breaking it apart gives 2 words: retro, erp. Average segment length settles at 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

75.19s

Total Load Time

3.4 MB

Total Size

Language Analysis

Primary Language

🇸🇦Arabic

Code: ar

Confidence:80%

Script:Arabic

Direction:rtl

Detection Details

HTML Lang Attribute:ar

Text Length:22,526 chars

Detector Agreement:50%

Website Classification

Primary Category

entertainment media98% confidence

Type: spa

Method: ml+structural

All Detected Categories

entertainment media

98%

gambling betting

89%

government public service

71%

technology software

66%

phishing scam

62%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
17	162.215.253.151	Phoenix, Arizona, United States	AS46606Unified Layer
15	142.251.13.95Google · CDN	United States	AS15169Google LLC
15	103.224.212.214	Australia	AS133618Trellian Pty. Limited
15	142.251.14.94Google · CDN	United States	AS15169Google LLC
15	185.53.179.200	Germany	AS206834Team Internet AG
15	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
15	54.38.220.85	France	AS16276OVH SAS
15	94.23.162.163	Saarbrücken, Saarland, Germany	AS16276OVH SAS
122	8	-	-