Security Report: www.247productions.nl - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/d54cfa19-3c73-48bb-bdf3-ebfe9b8730e5 Domain and IP registration (RDAP)/api/v1/rdap/d54cfa19-3c73-48bb-bdf3-ebfe9b8730e5 Certificate Transparency/api/v1/ct/247productions.nl How often this domain was scanned/api/v1/domain/stats/247productions.nl Scan history for this domain/api/v1/domain/history/247productions.nl?limit=15

This website contacted 19 IPs in 3 countries across 22 domains to perform 86 HTTP transactions. The main domain is 247productions.nl and was registered 1 year 1 month ago.

Submitted URL: https://www.247productions.nl/

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Legitimate 4-year-old Dutch production company site compromised with a ClickFix fake-CAPTCHA kit: fake Cloudflare overlay pushes Windows/macOS Terminal paste commands, with EtherHiding RPC delivery confirmed by CRITICAL YARA, kit-roster and IDS hits.

Risk Factors (6)

Compromised legitimate WordPress site (domain 4+ years old, self-branded Dutch video production company) hijacked to serve a ClickFix fake-verification malware kit

Fake 'Human Verification' overlay impersonating Cloudflare with a fabricated Ray ID, instructing Windows users to open Terminal via Win+X and paste a copied command

Parallel macOS ClickFix variant staging a disguised shell command (base64 into a shell / curl piped to sh) copied to the clipboard

ErrTraffic/Exvicy minified WordPress injected loader (base64 blob XOR-decoded through charCodeAt and executed via new Function) present in the page body

EtherHiding delivery/exfiltration over blockchain RPC endpoints (Polygon/Binance-style RPC hosts such as polygon.gateway.tenderly.co, polygon-public.nodies.app) confirmed by 16 CRITICAL IDS EtherHiding alerts

Nine cross-origin JavaScript network targets contacted by page scripts, including known ClickFix/EtherHiding infrastructure flagged by threat intelligence

Domain age information unavailable

Details

Page Title

24/7 Productions – 24/7 Productions

Scan Type

public

Favicon Hash

MMH3: -104721534

MD5: 3a957814885cd21f5b1ece55cbc5c4f5

Domain Name Analysis

The domain 'www.247productions.nl' uses the Dutch country-code top-level domain (.nl) with subdomain 'www'. The core label '247productions' covers 14 characters split between four vowels and 7 consonants; it also includes 3 digits. Segmentation suggests two words: 247, productions. Median word length comes out to seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

33.75s

Total Load Time

10.8 MB

Total Size

Language Analysis

Primary Language

🇳🇱Dutch

Code: nl

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:nl-NL

Text Length:2,459 chars

Detector Agreement:75%

Website Classification

Primary Category

blog personal website88% confidence

Type: spa

Method: ml+structural

All Detected Categories

blog personal website

88%

technology software

82%

entertainment media

81%

documentation technical

77%

cryptocurrency blockchain

71%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
14	46.235.40.15	Netherlands	AS213192NetBase BV
4	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
4	132.145.155.63Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
4	104.19.229.21Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
4	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	104.20.23.154Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	104.18.13.205Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	172.67.130.228Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
86	19	-	-