Security Report: shifra.org.il - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/63a338cb-770b-4ed5-a85d-64119708dba0 Domain and IP registration (RDAP)/api/v1/rdap/63a338cb-770b-4ed5-a85d-64119708dba0 Certificate Transparency/api/v1/ct/shifra.org.il How often this domain was scanned/api/v1/domain/stats/shifra.org.il Scan history for this domain/api/v1/domain/history/shifra.org.il?limit=15

This website contacted 13 IPs in 3 countries across 11 domains to perform 16 HTTP transactions. The main domain is shifra.org.il and was registered 21 years ago.

Submitted URL: https://shifra.org.il

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Compromised site running the CRITICAL ClickFix/EtherHiding kit: a fake Cloudflare verification overlay whose obfuscated loader resolves its next stage from a Polygon contract. Confirmed malicious — do not interact.

Risk Factors (6)

Known malicious ClickFix/EtherHiding kit present on the page (roster + YARA CRITICAL)

EtherHiding: obfuscated script retrieves its next-stage host from a Polygon smart contract

Obfuscated script hides threat-feed hosts (1rpc.io, polygon.drpc.org, polygon.gateway.tenderly.co)

Fake Cloudflare human-verification overlay impersonating the Cloudflare brand

Page connects to blockchain RPC endpoints (rpc.ankr.com, polygon.gateway.tenderly.co, blastapi.io) used for payload resolution

Primary domain shifra.org.il reported as a malware loader; unranked with injected spam content

Domain age information unavailable

Details

Page Title

שפרה – פשוט לאהוב

Scan Type

public

Domain Name Analysis

Within the Israeli country-code top-level domain (.org.il), 'shifra.org.il' is registered without a subdomain. Count 6 characters in 'shifra' split between 2 vowels and four consonants. Word splitting yields two words: shi, fra. Median word length is 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.13s

Total Load Time

830 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:he-IL

Text Length:156 chars

Detector Agreement:100%

Language mismatch: Declared as he-IL but detected as en

Website Classification

Primary Category

entertainment media91% confidence

Type: static

Method: ml+structural

All Detected Categories

entertainment media

91%

gambling betting

85%

adult content

79%

finance banking

71%

technology software

64%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	103.101.85.146	United Kingdom	AS199479Amtp LLC
1	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
1	104.16.124.96Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
1	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
1	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	151.101.65.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
16	13	-	-