Security Scan: https://ramonnfabro.adv.br

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/b384dc48-72b9-4412-8d06-465c1a8864bb Domain and IP registration (RDAP)/api/v1/rdap/b384dc48-72b9-4412-8d06-465c1a8864bb Certificate Transparency/api/v1/ct/ramonnfabro.adv.br How often this domain was scanned/api/v1/domain/stats/ramonnfabro.adv.br Scan history for this domain/api/v1/domain/history/ramonnfabro.adv.br?limit=15

This website contacted 32 IPs in 3 countries across 20 domains to perform 210 HTTP transactions. The main domain is ramonnfabro.adv.br and was registered 21 years ago.

Submitted URL: https://ramonnfabro.adv.br

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Legitimate-looking Brazilian law firm site (3-year-old domain) whose WordPress pages are compromised: a CRITICAL YARA/kit-roster ErrTraffic-Exvicy loader plus 3 CRITICAL EtherHiding malware IDS alerts are served. Do not interact; report the infection.

Risk Factors (5)

CRITICAL YARA detection of ErrTraffic/Exvicy injected WordPress loader executing Base64-XOR-decoded code via the Function constructor

Analyst-vetted known malicious kit (ErrTraffic / Exvicy) confirmed on page content

Critical IDS malware alerts (ET MALWARE EtherHiding Exfil M2, x3) and blockchain RPC traffic consistent with EtherHiding exfiltration

Malicious third-party resource loaded (makeverizyjar.info) alongside a flagged smart-chain/RPC endpoint (rpc-mainnet.matic.quiknode.pro)

Primary domain also reported as a malware loader in threat intelligence (single source)

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Favicon Hash

MMH3: -2123472111

MD5: 9844cf5b068988f6daa2dcaf87c6fa68

Domain Name Analysis

Within the Brazilian country-code top-level domain (.adv.br), 'ramonnfabro.adv.br' is registered and has no subdomain. The registrable portion 'ramonnfabro' spans 11 characters split between 4 vowels and seven consonants. Word splitting yields 4 words: ramon, nf, a, bro. Average segment length settles at 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

9.24s

Total Load Time

4.2 MB

Total Size

Language Analysis

Primary Language

🇵🇹Portuguese

Code: pt

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pt-BR

Text Length:5,603 chars

Detector Agreement:67%

Website Classification

Primary Category

government public service95% confidence

Type: spa

Method: ml+structural

All Detected Categories

government public service

95%

blog personal website

86%

social media network

80%

corporate business

64%

cryptocurrency blockchain

54%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
24	187.108.207.21	Brazil	AS53107EVEO S.A.
6	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	142.251.14.97Google · CDN	United States	AS15169Google LLC
6	172.66.164.193Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
6	142.251.154.119Google · CDN	United States	AS15169Google LLC
6	142.251.110.148Google · CDN	United States	AS15169Google LLC
6	132.145.155.63Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
6	216.239.32.36Google · CDN	United States	AS15169Google LLC
6	142.251.157.119Google · CDN	United States	AS15169Google LLC
210	32	-	-