Security Scan: Instituto de Bienestar

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/caa1a5a2-6d24-4e84-a6cc-05c6d3cd5397 Domain and IP registration (RDAP)/api/v1/rdap/caa1a5a2-6d24-4e84-a6cc-05c6d3cd5397How often this domain was scanned/api/v1/domain/stats/institutodebienestar.org Scan history for this domain/api/v1/domain/history/institutodebienestar.org?limit=15

This website contacted 20 IPs in 3 countries across 16 domains to perform 81 HTTP transactions. The main domain is institutodebienestar.org and was registered 8 years ago.

Submitted URL: https://institutodebienestar.org

Effective URL:

https://www.institutodebienestar.org/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Legitimate 8-year-old Spanish institute site whose WordPress install has been compromised: an injected ClickFix kit draws a fake Cloudflare 'Human Verification' overlay telling Windows users to paste a Terminal command, with CRITICAL EtherHiding exfiltration IDS alerts and a corroborated malware match on the primary domain. Do not paste anything; leave the page.

Risk Factors (5)

Known malicious ClickFix (Win+X -> Terminal) overlay kit injected into the page, analyst-vetted as CRITICAL phishing

CRITICAL network IDS detection of EtherHiding exfiltration to blockchain/Ethereum contracts

Malware threat-intelligence match on the primary domain corroborated by two independent feeds

Fake Cloudflare 'Human Verification' branding and Ray ID used to lend false authority to the lure

External threat-intel matches on page-loaded resources (quiknode.pro RPC, checkyoubrowse.codes, malicious IP 178.16.52.101)

Domain age information unavailable

Details

Page Title

Instituto de Bienestar

Scan Type

public

Favicon Hash

MMH3: 474178908

MD5: 40c95ea8d85c57e1489d84f602d274b3

Domain Name Analysis

Domain 'institutodebienestar.org' uses the non-profit oriented generic top-level domain (.org) while skipping any subdomain. Count 20 characters in 'institutodebienestar' containing 9 vowels alongside eleven consonants. Segmentation suggests 4 words: instituto, de, bien, estar. Median word length comes out to 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

5.90s

Total Load Time

4.8 MB

Total Size

Language Analysis

Primary Language

🇪🇸Spanish

Code: es

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:es

Text Length:3,783 chars

Detector Agreement:75%

Website Classification

Primary Category

healthcare medical42% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

42%

government public service

41%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
5	51.92.6.164Aws · CLOUD	Zaragoza, Aragon, Spain	AS16509Amazon.com, Inc.
4	217.160.0.3	Germany	AS8560IONOS SE
4	142.251.20.97Google · CDN	United States	AS15169Google LLC
4	142.251.110.95Google · CDN	United States	AS15169Google LLC
4	150.136.141.142Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
4	142.251.153.119Google · CDN	United States	AS15169Google LLC
4	85.118.245.69	Spain	AS35171Uniway Technologies SL
4	142.251.20.94Google · CDN	United States	AS15169Google LLC
4	216.239.32.36Google · CDN	United States	AS15169Google LLC
4	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
81	20	-	-