Security Scan: AF CONSTRUCTION

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e02bccdb-b4ec-4f7c-b98a-4cde143d308b Domain and IP registration (RDAP)/api/v1/rdap/e02bccdb-b4ec-4f7c-b98a-4cde143d308bHow often this domain was scanned/api/v1/domain/stats/afconstruc.com Scan history for this domain/api/v1/domain/history/afconstruc.com?limit=15

This website contacted 18 IPs in 3 countries across 17 domains to perform 114 HTTP transactions. The main domain is afconstruc.com and was registered 3 years ago.

Submitted URL: https://afconstruc.com

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Legitimate AF Construction site compromised with an injected ClickFix kit: a fake Cloudflare 'Human Verification' overlay tells Windows users to open Terminal and paste a blockchain-loaded payload. Confirmed malware distribution.

Risk Factors (5)

Compromised legitimate site serving an injected ClickFix malware kit

Fake Cloudflare 'Human Verification' overlay impersonating Cloudflare branding and Ray ID

Instructions to open Windows Terminal and paste an attacker payload (ClickFix)

EtherHiding: obfuscated script retrieves its next stage from a blockchain smart contract

Content-malware Indicators of Compromise against the primary domain (multiple corroborated feeds) and its loaded resources

Domain age information unavailable

Details

Page Title

AF CONSTRUCTION

Scan Type

public

Favicon Hash

MMH3: 1772785195

MD5: 0c58504c1ee8e7848b77cacd87f98b5f

Domain Name Analysis

Domain 'afconstruc.com' uses the commercial generic top-level domain (.com). The second-level label 'afconstruc' is 10 characters long holding three vowels versus seven consonants. Segmentation suggests four words: afc, on, st, ruc. The median word length lands at 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

5.33s

Total Load Time

2.8 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:41%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:es

Text Length:3,463 chars

Detector Agreement:67%

Language mismatch: Declared as es but detected as en

Website Classification

Primary Category

documentation technical28% confidence

Type: spa

Method: ml+structural

All Detected Categories

documentation technical

28%

adult content

28%

government public service

26%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
12	51.161.122.78	Canada	AS16276OVH SAS
6	192.178.183.95Google · CDN	United States	AS15169Google LLC
6	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	142.251.127.113Google · CDN	United States	AS15169Google LLC
6	104.21.3.152Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	172.66.164.193Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
6	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
6	142.251.14.94Google · CDN	United States	AS15169Google LLC
6	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
114	18	-	-