ScanMalware.com

Security Scan Report: andiefreude.at

Site favicon
Submitted: Oct 14, 2026, 5:58:28 PMCompleted: Oct 14, 2026, 5:59:11 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Legitimate-looking flower-art site compromised with the IClickFix/EtherHiding loader: obfuscated script pulls a ClickFix/malware stage from an Ethereum Sepolia contract (CRITICAL YARA + IDS). Page serves malware to visitors; do not interact.

Risk Factors (6)
Known malicious kit (IClickFix EtherHiding) injected into the page
EtherHiding: payload stage address retrieved from an Ethereum Sepolia smart contract
Obfuscated script conceals blockchain/RPC exfiltration hosts (tenderly, 1rpc.io)
CRITICAL Suricata malware alert on the connection
External third-party resource (zvh3.com) flagged as clickfix malware by two feeds
Primary domain listed in threat intelligence as a malware loader
Domain age information unavailable

Details

Page Title

an_die_fre_ude – WHEN FLOWERS TURN INTO ART

Scan Type

public

Domain Name Analysis

The domain 'andiefreude.at' uses the Austrian country-code top-level domain (.at). The core label 'andiefreude' covers 11 characters containing six vowels alongside 5 consonants. It segments into 2 words: andie, freude. Median word length is 5.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://andiefreude.at

Page Load Overview

3.07s
Total Load Time
12.2 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:6,568 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: spa
Method: structural

All Detected Categories

No categories detected

Detected Features

Articles
OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2385.13.144.172Germany
AS34788Neue Medien Muennich GmbH
22104.26.12.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
22104.21.72.64Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
673--

Detected Technologies7

WordPress
100%
Open-Graph-Protocolvwebsite
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%
Lightbox
20%
Bricks
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1CC547C31A0B9B477502F6BD4B8D67728618B8126D34F17F3A1E6108DCACC9F506B76D8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:IiQGUjzkFLqgkvTgkvCegkv4gkvv83gkvMJeQKtvMb3pgZJMV6q:IeUjzdgkvTgkvrgkv4gkvvQgkvYek

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:289889:ICARo6BGCs0swi5AGECqBUckhJI8q4qU6AUkqKUwBJgDjAQaHUAYXxjeTnKVKQIHQbQAICRQplFBIlRAiRQaSIxQIjCAVC+O

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffff00000000
Perceptual Hash:fadfb94888b78058
Difference Hash:1139696da1c52909
Wavelet Hash:ffffffff00000000
Color Hash:#b7bf40

Other Hashes

Crop Resistant:1139696da1c52909,38296c29b1cf390f

Scan History

Scan history not available

Unable to load historical scan data