Security Scan Report: carefield-zorg.nl

Site favicon
Submitted: Sep 22, 2026, 11:47:25 PMCompleted: Sep 22, 2026, 11:48:02 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Established Dutch care site appears compromised: primary domain flagged as malware loader, a loaded resource (xaz2.com) is corroborated malware, and a CRITICAL IDS alert flags EtherHiding exfiltration via an Ethereum RPC endpoint. Avoid visiting until cleaned.

Risk Factors (5)
Primary domain matched as a malware loader (unverified single source)
External resource xaz2.com corroborated as malware across 2 feeds
CRITICAL Suricata alert for EtherHiding malware exfiltration
Ethereum RPC domain (0xrpc.io) contacted — used to hide C2 in blockchain data
Self-hosted WordPress compromised and injecting malicious third-party scripts
Domain age information unavailable

Details

Page Title

Carefield Zorg – Beschermd Wonen

Scan Type

public

Domain Name Analysis

The domain name 'carefield-zorg.nl' uses the Dutch country-code top-level domain (.nl) and has no subdomain. Its registrable label 'carefield-zorg' stretches across 14 characters split between 5 vowels and eight consonants, plus one hyphen. Breaking it apart gives four words: care, field, z, org. Average segment length settles at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://carefield-zorg.nl

Page Load Overview

4.51s
Total Load Time
1.3 MB
Total Size

Language Analysis

Primary Language

🇳🇱Dutch
Code: nl
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:nl-NL
Text Length:1,399 chars
Detector Agreement:50%

Website Classification

Primary Category

healthcare medical48% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

healthcare medical
48%
adult content
35%
government public service
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
862.84.245.142Netherlands
AS48635Your Hosting B.V.
7146.19.24.104Poland
AS201814MEVSPACE sp. z o.o.
7188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
223--

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T112430831A3A050F17E5F877A6192B32C6648FA41CE4667E7B0F9E11885C85FB04A7F0E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:f9i5Q62I/xE6x4g5bn/yRKFH8b0deZdypQvBnt8+0:liClieypQZnt8+0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:58645:QyCqAFlgWUYeVQRkABIY8AAGIOAEMWqQAhgITDygECgIl2UqFUiSxsWQCYAEAdcKAIrEGglRWrZANIGQxKKMKKIJ2EQAAMAF

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe3c3c3c3e7
Perceptual Hash:e4df9b20cc669931
Difference Hash:224c480696968e8c
Wavelet Hash:90eee6c2c3c3c3c3
Color Hash:#533a78

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data