Security Report: cafedesamis.it - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/eaa284bd-e0db-4d8e-9b59-bb2700ffd8d3 Domain and IP registration (RDAP)/api/v1/rdap/eaa284bd-e0db-4d8e-9b59-bb2700ffd8d3 Certificate Transparency/api/v1/ct/cafedesamis.it How often this domain was scanned/api/v1/domain/stats/cafedesamis.it Scan history for this domain/api/v1/domain/history/cafedesamis.it?limit=15

This website contacted 29 IPs in 3 countries across 21 domains to perform 111 HTTP transactions. The main domain is cafedesamis.it and was registered 21 years ago.

Submitted URL: https://cafedesamis.it

Effective URL:

https://www.cafedesamis.it/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Legitimate-looking Italian café site compromised and serving a ClickFix fake-CAPTCHA that lures users into pasting PowerShell malware; IDS confirms EtherHiding exfiltration. Do not interact or run any command.

Risk Factors (5)

Fake CAPTCHA with manual 'verification' steps that instruct the user to run PowerShell commands

Critical IDS malware alerts (EtherHiding exfiltration, x20)

Blockchain RPC connections used for payload retrieval/staging

Threat-intelligence match for lummac2 malware on the primary domain

eval() dynamic code execution on the page

Domain age information unavailable

Details

Page Title

Café Des Amis | Fregene

Scan Type

public

Favicon Hash

MMH3: -408657616

MD5: 1a9cffb46c2a5f04f357dd7c69ce48df

Domain Name Analysis

The domain name 'cafedesamis.it' uses the Italian country-code top-level domain (.it) and has no subdomain. Count 11 characters in 'cafedesamis' containing 5 vowels alongside six consonants. Tokenizing the label suggests 3 words: cafe, desam, is. Median word length comes out to four characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

19.88s

Total Load Time

20.3 MB

Total Size

Language Analysis

Primary Language

🇮🇹Italian

Code: it

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:it-IT

Text Length:4,207 chars

Detector Agreement:50%

Website Classification

Primary Category

blog personal website89% confidence

Type: spa

Method: ml+structural

All Detected Categories

blog personal website

89%

government public service

88%

entertainment media

87%

education learning

86%

finance banking

84%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
27	89.46.107.228	Arezzo, Tuscany, Italy	AS31034Aruba S.p.A.
3	142.250.154.95Google · CDN	United States	AS15169Google LLC
3	142.251.14.95Google · CDN	United States	AS15169Google LLC
3	15.197.152.159Aws · CLOUD	United States	AS16509Amazon.com, Inc.
3	15.197.198.189Aws · CLOUD	United States	AS16509Amazon.com, Inc.
3	35.71.129.99Aws · CLOUD	United States	AS16509Amazon.com, Inc.
3	142.215.53.55	Washington, District of Columbia, United States	AS15830Equinix (EMEA) Acquisition Enterprises B.V.
3	104.18.10.59Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	172.66.150.162Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
111	29	-	-