Security Report: haarsalon-tonina.de - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ee51590b-73bc-47ae-aafa-8dd2a8e6aecb Domain and IP registration (RDAP)/api/v1/rdap/ee51590b-73bc-47ae-aafa-8dd2a8e6aecb Certificate Transparency/api/v1/ct/haarsalon-tonina.de How often this domain was scanned/api/v1/domain/stats/haarsalon-tonina.de Scan history for this domain/api/v1/domain/history/haarsalon-tonina.de?limit=15

This website contacted 29 IPs in 2 countries across 18 domains to perform 74 HTTP transactions. The main domain is haarsalon-tonina.de and was registered 18 years ago.

Submitted URL: https://haarsalon-tonina.de/

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Legitimate hair-salon site has been compromised and now serves an injected ClickFix/Cloudflare-lookalike overlay that tricks Windows users into pasting and running malware via Terminal; EtherHiding blockchain C2 confirmed by IDS.

Risk Factors (5)

Known malicious ClickFix kit injected into page (analyst-vetted roster match)

Fake Cloudflare 'Human Verification' overlay (Ray ID, 'Authorize your browser now') impersonating Cloudflare

Terminal/PowerShell paste-and-run social engineering targeting Windows users

Multiple CRITICAL EtherHiding Exfil IDS alerts

Blockchain RPC connections used for obfuscated payload delivery

Domain age information unavailable

Details

Page Title

Home - Tonina

Scan Type

public

Favicon Hash

MMH3: -213128781

MD5: 87393d3bfecdd5fd02c18ff756789206

Domain Name Analysis

You're looking at domain 'haarsalon-tonina.de' on the German country-code top-level domain (.de) while skipping any subdomain. The second-level label 'haarsalon-tonina' is 16 characters long with 7 vowels and 8 consonants, notching 1 hyphen. Tokenizing the label suggests 5 words: h, aar, salon, to, nina. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.29s

Total Load Time

5.3 MB

Total Size

Language Analysis

Primary Language

🇩🇪German

Code: de

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:de

Text Length:4,414 chars

Detector Agreement:75%

Website Classification

Primary Category

adult content93% confidence

Type: spa

Method: ml+structural

All Detected Categories

adult content

93%

blog personal website

60%

documentation technical

55%

healthcare medical

52%

government public service

38%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
18	217.160.0.151	Germany	AS8560IONOS SE
2	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.110.95Google · CDN	United States	AS15169Google LLC
2	104.18.0.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	150.136.141.142Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
2	172.217.116.4Google · CDN	United States	AS15169Google LLC
2	142.251.14.97Google · CDN	United States	AS15169Google LLC
2	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
2	216.239.32.36Google · CDN	United States	AS15169Google LLC
74	29	-	-