Security Report: recuperatoarecaldura.ro - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e0922755-ae89-4eef-9bbf-5994fdd8be9b Domain and IP registration (RDAP)/api/v1/rdap/e0922755-ae89-4eef-9bbf-5994fdd8be9b Certificate Transparency/api/v1/ct/recuperatoarecaldura.ro How often this domain was scanned/api/v1/domain/stats/recuperatoarecaldura.ro Scan history for this domain/api/v1/domain/history/recuperatoarecaldura.ro?limit=15

This website contacted 9 IPs in 3 countries across 8 domains to perform 104 HTTP transactions. The main domain is recuperatoarecaldura.ro and was registered 30 years ago.

Submitted URL: https://recuperatoarecaldura.ro

AI Security Verdict

High Risk

Confidence: 93%

Risk Score

Established Romanian HVAC site appears compromised: a ClearFake/EtherHiding blockchain loader (critical YARA, kit roster, 5 critical IDS exploit-kit alerts, Safe Browsing) is injected and serves malware. Avoid visiting; owner should clean the site.

Risk Factors (5)

Injected ClearFake/EtherHiding blockchain-contract malware loader on the page (critical YARA + analyst-vetted kit roster match)

Critical IDS exploit-kit alerts for TA569 Gholoader TDS and TA2726 fake WordPress plugin CnC payloads

Obfuscated JavaScript hides known-malicious blockchain RPC hosts used for next-stage retrieval

Google Safe Browsing: Unwanted Software detected

Compromised WordPress installation acting as a malware distribution vector

Domain age information unavailable

Details

Page Title

Recuperatoare de caldura – Atrea Romania

Scan Type

public

Domain Name Analysis

You're looking at domain 'recuperatoarecaldura.ro' on the Romanian country-code top-level domain (.ro) and has no subdomain. The core label 'recuperatoarecaldura' covers 20 characters holding 10 vowels versus ten consonants. Splitting it apart reveals seven words: re, cup, era, to, are, cal, dura. Median word length is 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

18.79s

Total Load Time

1.3 MB

Total Size

Language Analysis

Primary Language

🇷🇴Romanian

Code: ro

Confidence:29%

Script:Unknown

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:4,777 chars

Detector Agreement:75%

Language mismatch: Declared as en-US but detected as ro

Website Classification

Primary Category

government public service57% confidence

Type: spa

Method: ml+structural

All Detected Categories

government public service

57%

news media journalism

50%

healthcare medical

50%

blog personal website

45%

corporate business

43%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
16	89.42.218.248	Romania	AS205275ROMARG SRL
11	192.178.183.97Google · CDN	United States	AS15169Google LLC
11	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
11	216.239.34.36Google · CDN	United States	AS15169Google LLC
11	142.251.127.155Google · CDN	United States	AS15169Google LLC
11	142.251.14.94Google · CDN	United States	AS15169Google LLC
11	157.240.0.35Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
11	151.236.16.211	Los Angeles, California, United States	AS9009M247 Europe SRL
11	216.239.32.36Google · CDN	United States	AS15169Google LLC
104	9	-	-