Security Report: tooth-fairy.rf.gd - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/cd20c4b4-7965-4d68-a42d-9be2d9632bbf Domain and IP registration (RDAP)/api/v1/rdap/cd20c4b4-7965-4d68-a42d-9be2d9632bbfHow often this domain was scanned/api/v1/domain/stats/tooth-fairy.rf.gd Scan history for this domain/api/v1/domain/history/tooth-fairy.rf.gd?limit=15

This website contacted 16 IPs in 4 countries across 10 domains to perform 95 HTTP transactions. The main domain is rf.gd and was registered 13 years ago.

Submitted URL: https://tooth-fairy.rf.gd

Effective URL:

https://tooth-fairy.rf.gd/?i=1

Redirected

The Cisco Umbrella rank of the primary domain is #334,284 of the top 1 million websites

AI Security Verdict

Confirmed Scam

Confidence: 88%

Risk Score

Free rf.gd WordPress template page whose own domain is flagged ClearFake and which loads a multi-feed-confirmed ClearFake exploit-kit domain, alongside nine CRITICAL EtherHiding exfiltration IDS alerts and blockchain RPC C2 traffic. Treat as a malware-distribution host; do not visit or interact.

Risk Factors (5)

Content-malware threat-intel match (ClearFake) on the scanned primary domain

Multi-feed corroborated malicious EK ClearFake domain (interseq.at) loaded as a page resource

Nine CRITICAL IDS alerts for EtherHiding exfiltration traffic

Blockchain RPC domains contacted in DNS/TLS-SNI consistent with EtherHiding C2

Generic template content on an anonymous free-subdomain host with no real business identity

Domain age information unavailable

Details

Page Title

My Blog – My WordPress Blog

Scan Type

public

Favicon Hash

MMH3: 1437812077

MD5: 524a878422f28c4f42de729822fb6e81

Domain Name Analysis

The domain 'tooth-fairy.rf.gd' uses the .gd country-code top-level domain; it also runs on subdomain 'tooth-fairy'. The registrable portion 'rf' spans 2 characters holding zero vowels versus 2 consonants. Splitting it apart reveals one word: rf. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

90.32s

Total Load Time

4.5 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:6,265 chars

Detector Agreement:75%

Website Classification

Primary Category

healthcare medical82% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

82%

news media journalism

79%

gambling betting

63%

government public service

52%

entertainment media

47%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
20	185.27.134.140	United Kingdom	AS34119Wildcard UK Limited
5	104.26.5.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	185.7.214.119	Harlesden, England, United Kingdom	AS55286B2 Net Solutions Inc.
5	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	142.250.154.95Google · CDN	United States	AS15169Google LLC
5	193.233.126.164	Amsterdam, North Holland, Netherlands	AS209207Digital Hosting Provider LLC
5	172.67.130.228Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	172.217.116.4Google · CDN	United States	AS15169Google LLC
5	142.251.110.94Google · CDN	United States	AS15169Google LLC
5	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
95	16	-	-