Security Report: www.bestforme.net - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/cc189a02-c992-4252-916e-5cb01bfcbbe4 Domain and IP registration (RDAP)/api/v1/rdap/cc189a02-c992-4252-916e-5cb01bfcbbe4How often this domain was scanned/api/v1/domain/stats/bestforme.net Scan history for this domain/api/v1/domain/history/bestforme.net?limit=15

This website contacted 20 IPs in 2 countries across 12 domains to perform 46 HTTP transactions. The main domain is bestforme.net and was registered 10 years ago.

Submitted URL: https://www.bestforme.net/

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Legitimate-looking travel blog that has been compromised: it injects an ErrTraffic/Exvicy WordPress loader and a fake Cloudflare ClickFix 'Human Verification' overlay that tricks Windows users into pasting malware in Terminal, with blockchain-based EtherHiding exfiltration.

Risk Factors (5)

Injected ErrTraffic/Exvicy loader executing obfuscated atob/XOR-decoded JavaScript via new Function (5 eval and 4 Function() constructor calls)

Fake Cloudflare-style 'Human Verification' ClickFix overlay instructing users to paste commands into Windows Terminal (Win+X)

EtherHiding abuse of a Polygon/Matic blockchain RPC endpoint for payload retrieval and exfiltration (CRITICAL IDS alerts)

Compromised WordPress site (WPEnjoy theme, Powered by WordPress) repurposed to serve malware to visitors

Threat-intel corroboration across multiple feeds on the primary domain and loaded resources

Domain age information unavailable

Details

Page Title

Best For Me! – bestforme.net

Scan Type

public

Favicon Hash

MMH3: -2124489258

MD5: 3d19b3b80be02afbcbe24cc5455c78a1

Domain Name Analysis

Domain 'www.bestforme.net' uses the network infrastructure generic top-level domain (.net) with subdomain 'www'. Its registrable label 'bestforme' stretches across 9 characters holding 3 vowels versus six consonants. Splitting it apart reveals 2 words: best, forme. Median word length is 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.01s

Total Load Time

1.8 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:3,648 chars

Detector Agreement:75%

Website Classification

Primary Category

travel tourism83% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

travel tourism

83%

blog personal website

67%

phishing scam

55%

government public service

50%

education learning

41%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	172.67.154.81Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	150.136.141.142Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
2	142.251.152.4Google · CDN	United States	AS15169Google LLC
2	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
2	104.21.48.157Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.155.4Google · CDN	United States	AS15169Google LLC
2	142.251.153.4Google · CDN	United States	AS15169Google LLC
2	142.251.157.4Google · CDN	United States	AS15169Google LLC
2	142.250.154.94Google · CDN	United States	AS15169Google LLC
2	142.251.14.157Google · CDN	United States	AS15169Google LLC
46	20	-	-