ScanMalware.com

Security Scan Report: cloudflare.bz

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/b9b2c11b-38ba-4486-8f8f-187b1dedea92Domain and IP registration (RDAP)/api/v1/rdap/b9b2c11b-38ba-4486-8f8f-187b1dedea92How often this domain was scanned/api/v1/domain/stats/cloudflare.bzScan history for this domain/api/v1/domain/history/cloudflare.bz?limit=15
This website contacted 4 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main domain is cloudflare.bz and was registered 1 week ago.

Submitted URL: https://cloudflare.bz/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Fake Cloudflare 'human verification' page on a 7-day-old lookalike domain; analyst-vetted ClickFix kits and three YARA rules confirm a clipboard-paste malware lure. Never paste its commands.

Risk Factors (6)
Known malicious ClickFix fake-CAPTCHA kit (CRITICAL) matched by analyst-vetted roster and YARA
Brand impersonation of Cloudflare on a non-Cloudflare, 7-day-old domain
Fake 'Verify you are human' overlay designed to make visitors paste clipboard commands into Terminal/PowerShell
LOLBin payload delivery (msiexec/mshta/wmic/certutil/regsvr32) indicates malware install rather than verification
Page scripts contact unranked third-party domains for beaconing
Typosquat-style hostname using a well-known security brand plus a .biz TLD
Domain age information unavailable

Details

Page Title

Сloudflare

Scan Type

public

Domain Name Analysis

The domain name 'cloudflare.bz' uses the Belizean country-code top-level domain (.bz) with no subdomain. The core label 'cloudflare' covers 10 characters containing 4 vowels alongside 6 consonants. Segmentation suggests 2 words: cloud, flare. Median word length comes out to 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://cloudflare.bz/

Page Load Overview

0.15s
Total Load Time
210 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:10 chars
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1147.45.61.63Amsterdam, North Holland, Netherlands
AS209207Digital Hosting Provider LLC
1193.233.126.164Amsterdam, North Holland, Netherlands
AS209207Digital Hosting Provider LLC
1172.67.70.252Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1195.58.146.210Denmark
AS9009M247 Europe SRL
44--

Detected Technologies3

Meta-Refresh-Redirect
100%
reCAPTCHA
45%
Nginx
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D252721BF4F21A32D3A682B055B7773C6B3D992E8FC10C74A94A677A0B4AED712451CC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:SFLBy1MvUeJb6BEZwP1XvaFUdJEUWocOF/0P7sU:S7FoIq1XSW4ocLwU

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:14188:gg3AugLEEBABAATEkQIYBLwgHm6IETEIEBzLYGWUUGigQgmgUkEgC6BBjaBHigAASFCgACmIQiQbAGUUqAE5AgoImoIFsAga

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fcfcceeefece7e00
Perceptual Hash:d1d546d60ab13b99
Difference Hash:0424181a2a1a86c1
Wavelet Hash:fcfcccfc2e023e00
Color Hash:#693a78

Other Hashes

Crop Resistant:0424181a2a1a86c1

Scan History

Scan history not available

Unable to load historical scan data