Security Scan Report: ilovegraalmueritz.de

Redirected to:
https://www.ilovegraalmueritz.de/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 9 IPs in 3 countries across 13 domains to perform 92 HTTP transactions. The main domain is ilovegraalmueritz.de and was registered 7 years ago.

Submitted URL: https://ilovegraalmueritz.de

Effective URL:
https://www.ilovegraalmueritz.de/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Genuine Graal-Müritz souvenir shop whose page has been compromised: an obfuscated ClickFix/EtherHiding loader (blockchain-hosted next stage) is injected, confirmed by kit roster, critical IDS alert and multi-feed malware threat-intel. Do not visit until cleaned.

Risk Factors (5)
Compromised page injecting a ClickFix / EtherHiding malware loader into visitors' browsers
Ethereum Sepolia smart-contract dead-drop used to fetch and decrypt the next-stage payload
Obfuscated script concealing known-attacker RPC/relay hosts
Critical IDS malware-exfiltration alert on the same page
Two independent malware threat-feed reports against the hosting domain
Domain age information unavailable

Details

Page Title

Home - I love Graal-Müritz

Scan Type

public

Domain Name Analysis

You're looking at domain 'ilovegraalmueritz.de' on the German country-code top-level domain (.de) while skipping any subdomain. Count 17 characters in 'ilovegraalmueritz' split between eight vowels and nine consonants. Tokenizing the label suggests 6 words: i, love, gra, a, lmu, eritz. Expect 3 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ilovegraalmueritz.de

Page Load Overview

7.22s
Total Load Time
1.6 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:6,730 chars
Detector Agreement:80%

Website Classification

Primary Category

social media network100% confidence
Type: spa
Method: ml+structural

All Detected Categories

social media network
100%
blog personal website
97%
real estate property
64%
adult content
49%
travel tourism
48%

Detected Features

Search
Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1278.46.5.142Nuremberg, Bavaria, Germany
AS24940Hetzner Online GmbH
10142.251.14.95Google · CDNUnited States
AS15169Google LLC
10192.0.76.3San Francisco, California, United States
AS2635Automattic, Inc
10142.250.154.94Google · CDNUnited States
AS15169Google LLC
10146.75.121.21Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
1034.147.177.40Google · CDNCity of London, England, United Kingdom
AS396982Google LLC
10146.75.121.35Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
10104.26.4.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10104.21.72.64Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
929--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13D142CE24A2C24FA2757D78C6424F358366AE60DCE43D9D4F2AECD6C92D8DD11CE124E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:tbaoiLozdrl7dTgAAVABAO4AaGAZQVAPZkVw4yLFxGt+VdUWXba/6CtU9Abj/K8y:tb16iljFqgUWw4OGWXEGOi

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:203327:oQqRGQIBAbFdIYAYiigBIJA2a5AiGCowFoDoFMKBIQVEAaMBIWgKnUoHkOKtVCBMBAVACRB4ZgABoGMMKiNg90IFMSFRAgDg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3c3c3c3818181801
Perceptual Hash:88dd225e22dda277
Difference Hash:323232b17171708f
Wavelet Hash:bcff3c3c3c3c1801
Color Hash:#931f2d

Scan History

Scan history not available

Unable to load historical scan data