Security Report: lesteredesdeprotecao.com.br - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/c7ec5fd6-71c7-4f61-807f-d7f3c3cf0923 Domain and IP registration (RDAP)/api/v1/rdap/c7ec5fd6-71c7-4f61-807f-d7f3c3cf0923 Certificate Transparency/api/v1/ct/lesteredesdeprotecao.com.br How often this domain was scanned/api/v1/domain/stats/lesteredesdeprotecao.com.br Scan history for this domain/api/v1/domain/history/lesteredesdeprotecao.com.br?limit=15

This website contacted 41 IPs in 3 countries across 25 domains to perform 148 HTTP transactions. The main domain is lesteredesdeprotecao.com.br and was registered 8 years ago.

Submitted URL: https://lesteredesdeprotecao.com.br

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Legitimate Brazilian safety-net site compromised and injected with a ClickFix kit: fake Microsoft SmartScreen 'Verify it's you' overlay copies a shell command to the clipboard, with EtherHiding blockchain C2, YARA and IDS malware hits, and a domain IoC. Do not paste or run anything.

Risk Factors (6)

Known ClickFix malware kit injected into the page (analyst-vetted, CRITICAL) — fake CAPTCHA / fake Microsoft SmartScreen verification that stages a clipboard command for the visitor to execute

14 high-precision ClickFix YARA rule hits on the page HTML

Primary domain carries a multi-feed malware Indicators of Compromise hit ('clearfake')

CRITICAL IDS alerts for EtherHiding exfiltration and ClickFix C2 domain (gateway.tenderly.co) in DNS/TLS SNI

EtherHiding pattern: page scripts contact blockchain RPC endpoints (bsc-testnet.drpc.org, bsc-testnet-rpc.publicnode.com, polygon.gateway.tenderly.co) and sendBeacon to unranked renotad.com

Brand impersonation of Microsoft (SmartScreen / 'Microsoft account security') on a non-Microsoft domain

Domain age information unavailable

Details

Page Title

Leste Redes de Proteção – Redes de Proteção para sua família

Scan Type

public

Favicon Hash

MMH3: -1262899259

MD5: 3ada733806a716d874205681f8e771e3

Domain Name Analysis

You're looking at domain 'lesteredesdeprotecao.com.br' on the Brazilian country-code top-level domain (.com.br) while skipping any subdomain. The registrable portion 'lesteredesdeprotecao' spans 20 characters containing nine vowels alongside 11 consonants. It segments into 6 words: lester, e, des, dep, rote, cao. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.28s

Total Load Time

3.1 MB

Total Size

Language Analysis

Primary Language

🇵🇹Portuguese

Code: pt

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pt-PT

Text Length:2,791 chars

Detector Agreement:75%

Website Classification

Primary Category

blog personal website100% confidence

Type: spa

Method: ml+structural

All Detected Categories

blog personal website

100%

technology software

100%

finance banking

100%

cryptocurrency blockchain

100%

healthcare medical

100%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
28	50.116.112.43	Vinhedo, São Paulo, Brazil	AS31898Oracle Corporation
3	172.64.154.105Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	172.64.148.10Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	172.67.130.228Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.16.248.249Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	15.197.152.159Aws · CLOUD	United States	AS16509Amazon.com, Inc.
3	15.197.198.189Aws · CLOUD	United States	AS16509Amazon.com, Inc.
3	142.215.53.55	Washington, District of Columbia, United States	AS15830Equinix (EMEA) Acquisition Enterprises B.V.
3	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
148	41	-	-