Security Report: miguelromerosaiz.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/9c44dd6c-e818-4e68-ab65-dbb323af9a12 Domain and IP registration (RDAP)/api/v1/rdap/9c44dd6c-e818-4e68-ab65-dbb323af9a12How often this domain was scanned/api/v1/domain/stats/miguelromerosaiz.com Scan history for this domain/api/v1/domain/history/miguelromerosaiz.com?limit=15

This website contacted 3 IPs in 3 countries across 4 domains to perform 41 HTTP transactions. The main domain is miguelromerosaiz.com and was registered 19 years ago.

Submitted URL: https://miguelromerosaiz.com

Effective URL:

https://www.miguelromerosaiz.com/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Legitimate 19-year-old Spanish cultural site has been compromised: a ClickFix 'Human Verification' overlay pushes visitors to run PowerShell, with CRITICAL YARA/IDS hits and EtherHiding blockchain C2. Do not interact; leave immediately.

Risk Factors (5)

Known malicious ClickFix phishing kit injected into the page (Win+X → Terminal → paste PowerShell) — delivers OS-level malware to visitors

CRITICAL YARA rule ClickFix_WinX_Overlay_Kit hit on the HTML

CRITICAL IDS alert ET MALWARE EtherHiding Exfil M2 and blockchain RPC/Ethereum contract traffic, consistent with on-chain C2 (EtherHiding)

Multi-source corroborated malware threat-intel match on the primary domain (clearfake / unknown loader)

Legitimate 19-year-old site appears compromised and is being used to serve malware to its audience

Domain age information unavailable

Details

Page Title

Miguel Romero Sáiz – Página Web Oficial – Miguel Romero Sáiz – Página Web Oficial

Scan Type

public

Favicon Hash

MMH3: -1027931051

MD5: 76e123e582644a74cc33ac46b75ff602

Domain Name Analysis

The domain name 'miguelromerosaiz.com' uses the commercial generic top-level domain (.com) and has no subdomain. The registrable portion 'miguelromerosaiz' spans 16 characters split between 8 vowels and 8 consonants. Segmentation suggests 4 words: miguel, romero, s, aiz. Median word length comes out to 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.69s

Total Load Time

630 KB

Total Size

Language Analysis

Primary Language

🇪🇸Spanish

Code: es

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:es

Text Length:4,670 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical70% confidence

Type: spa

Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical

70%

adult content

51%

news media journalism

31%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
15	37.59.203.111	France	AS16276OVH SAS
13	132.145.155.63Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
13	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
41	3	-	-