Security Report: toivio.info - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/6d9300c2-85a3-474e-b45b-810a5f3fd1f3 Domain and IP registration (RDAP)/api/v1/rdap/6d9300c2-85a3-474e-b45b-810a5f3fd1f3How often this domain was scanned/api/v1/domain/stats/toivio.info Scan history for this domain/api/v1/domain/history/toivio.info?limit=15

This website contacted 10 IPs in 3 countries across 8 domains to perform 43 HTTP transactions. The main domain is toivio.info and was registered 14 years ago.

Submitted URL: https://toivio.info

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Legitimate 14-year-old Finnish village site apparently compromised with the IClickFix/EtherHiding ClickFix kit: 3 CRITICAL IDS alerts, analyst-vetted malicious kit, and blockchain-staged malware loader.

Risk Factors (5)

Known malicious ClickFix/EtherHiding kit injected into the page (IClickFix)

Three CRITICAL network IDS malware alerts (EtherHiding exfiltration, ClickFix domain DNS and TLS)

Obfuscated script retrieves its payload from an Ethereum smart contract (EtherHiding)

Third-party malware domain zvh4.com loaded; corroborated by two independent threat feeds

Primary domain flagged as malware loader by threat intelligence

Domain age information unavailable

Details

Page Title

Toivio – lintukoto keskellä kaikkea.

Scan Type

public

Favicon Hash

MMH3: -1387726387

MD5: a4a69dea42f250ac2cc9a771bbaa5b6e

Domain Name Analysis

Within the informational generic top-level domain (.info), 'toivio.info' is registered while skipping any subdomain. Count 6 characters in 'toivio' containing four vowels alongside 2 consonants. Tokenizing the label suggests three words: to, i, vio. Average segment length settles at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.78s

Total Load Time

27.6 MB

Total Size

Language Analysis

Primary Language

🇫🇮Finnish

Code: fi

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:fi

Text Length:777 chars

Detector Agreement:100%

Website Classification

Primary Category

corporate70% confidence

Type: spa

Method: structural

All Detected Categories

corporate

70%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	5.44.245.73	Finland	AS201692Zoner Oy
4	104.18.1.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	142.251.14.97Google · CDN	United States	AS15169Google LLC
4	5.9.82.93	Falkenstein, Saxony, Germany	AS24940Hetzner Online GmbH
4	192.178.183.94Google · CDN	United States	AS15169Google LLC
4	216.239.32.36Google · CDN	United States	AS15169Google LLC
4	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	104.18.0.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	216.239.34.36Google · CDN	United States	AS15169Google LLC
43	10	-	-