Security Report: demavaraes.site - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/aedde149-f2f4-4e9c-b044-b92d2fc0be0f Domain and IP registration (RDAP)/api/v1/rdap/aedde149-f2f4-4e9c-b044-b92d2fc0be0f Certificate Transparency/api/v1/ct/demavaraes.site How often this domain was scanned/api/v1/domain/stats/demavaraes.site Scan history for this domain/api/v1/domain/history/demavaraes.site?limit=15

This website contacted 23 IPs in 2 countries across 18 domains to perform 51 HTTP transactions. The main domain is demavaraes.site and was registered 4 years 10 months ago.

Submitted URL: https://demavaraes.site

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Confirmed ClickFix malware lure: a fake Cloudflare verification page (impersonating Cloudflare) tells Windows users to paste a command into Terminal. Domain flagged as malware by two feeds and hit by ClickFix YARA plus critical EtherHiding IDS alerts. Do not interact.

Risk Factors (5)

Known ClickFix malware kit delivering paste-into-Terminal social engineering

Brand impersonation of Cloudflare's security verification UI on a non-Cloudflare domain

Critical IDS malware alerts (EtherHiding exfiltration) associated with the page

Multi-source threat-intel corroboration flagging the primary domain as malware (clearfake)

Domain is only 94 days old, unranked in Cisco Umbrella, and served disallowed third-party script hosts

Domain age information unavailable

Details

Page Title

Cloudflare Tunnel error | demavaraes.site | Cloudflare

Scan Type

public

Domain Name Analysis

Domain 'demavaraes.site' uses the .site top-level domain with no subdomain. The registrable portion 'demavaraes' spans 10 characters holding five vowels versus five consonants. It segments into three words: dem, avar, aes. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.89s

Total Load Time

1.5 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:1,679 chars

Detector Agreement:67%

Website Classification

Primary Category

technology software56% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

56%

documentation technical

50%

phishing scam

28%

government public service

26%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	172.67.212.161Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.30.78Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.31.78Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	92.223.124.62	Frankfurt am Main, Hesse, Germany	AS199524G-Core Labs S.A.
2	64.185.181.238	United States	AS40009BitGravity, Inc.
2	185.111.111.156	Frankfurt am Main, Hesse, Germany	AS212238Datacamp Limited
2	34.111.241.208Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
2	108.138.7.13Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
2	146.75.121.194Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
2	23.50.131.156Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
51	23	-	-