Security Report: sklepydlarodzicow.pl - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/c12e8a26-0526-4077-b427-49eb0bdc106a Domain and IP registration (RDAP)/api/v1/rdap/c12e8a26-0526-4077-b427-49eb0bdc106aHow often this domain was scanned/api/v1/domain/stats/sklepydlarodzicow.pl Scan history for this domain/api/v1/domain/history/sklepydlarodzicow.pl?limit=15

This website contacted 15 IPs in 2 countries across 12 domains to perform 102 HTTP transactions. The main domain is sklepydlarodzicow.pl and was registered 15 years ago.

Submitted URL: https://sklepydlarodzicow.pl

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Compromised Polish retail domain serving a ClickFix overlay: fake Cloudflare verification instructing Win+X Terminal paste-and-run, with 19 CRITICAL ET MALWARE EtherHiding alerts and a roster-anchored ClickFix YARA hit. Malware delivery — avoid.

Risk Factors (6)

Fake Cloudflare-style 'security verification' overlay with Ray ID, impersonating Cloudflare branding without authorisation

ClickFix Terminal/PowerShell paste-and-run instruction — directs visitors to execute attacker-supplied commands, leading to infostealer/RAT installation

19 CRITICAL Suricata alerts: ET MALWARE EtherHiding Exfil M2 (network trojan, EtherHiding blockchain C2/exfil pattern)

Page scripts contact BNB Chain testnet RPC/data-seed endpoints (EtherHiding infrastructure) consistent with on-chain payload retrieval

Threat-intel match on the primary domain for a malware loader (single-source, unverified) corroborating the kit/YARA/IDS evidence

Established retail domain appears compromised and repurposed for malware delivery

Domain age information unavailable

Details

Page Title

Sklepy dla rodziców – Wszystko dla dziecka

Scan Type

public

Favicon Hash

MMH3: 1130840558

MD5: ca960c7839baa689146724b5a23ca8c9

Domain Name Analysis

The domain 'sklepydlarodzicow.pl' uses the Polish country-code top-level domain (.pl) while skipping any subdomain. The second-level label 'sklepydlarodzicow' is 17 characters long with 5 vowels and twelve consonants. Breaking it apart gives 7 words: s, kle, py, d, la, rodzi, cow. Median word length is two characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

9.85s

Total Load Time

795 KB

Total Size

Language Analysis

Primary Language

🇵🇱Polish

Code: pl

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pl-PL

Text Length:1,067 chars

Detector Agreement:67%

Website Classification

Primary Category

technology software79% confidence

Type: spa

Method: ml+structural

All Detected Categories

technology software

79%

documentation technical

61%

social media network

52%

phishing scam

45%

government public service

38%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
18	77.55.252.144	Poland	AS15967Nazwa.pl Sp.z.o.o.
6	142.251.13.95Google · CDN	United States	AS15169Google LLC
6	15.197.152.159Aws · CLOUD	United States	AS16509Amazon.com, Inc.
6	3.33.196.84Aws · CLOUD	United States	AS16509Amazon.com, Inc.
6	52.223.48.152Aws · CLOUD	United States	AS16509Amazon.com, Inc.
6	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	104.20.24.117Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	142.215.53.55	Washington, District of Columbia, United States	AS15830Equinix (EMEA) Acquisition Enterprises B.V.
6	15.197.198.189Aws · CLOUD	United States	AS16509Amazon.com, Inc.
6	142.251.110.95Google · CDN	United States	AS15169Google LLC
102	15	-	-