Security Scan Report: carolineschaay.nl

Submitted: Oct 12, 2026, 4:20:18 PMCompleted: Oct 12, 2026, 4:21:25 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Legitimate 23-year-old Dutch therapy site whose pages have been compromised: analyst-vetted IClickFix/EtherHiding and DarkSword iOS exploit-kit code plus CRITICAL IDS ClickFix C2 alerts are served to visitors. Do not load.

Risk Factors (5)
Known malicious ClickFix/EtherHiding loader injected into page HTML (compromised site)
DarkSword iOS exploit kit captcha gate and wallet-stealer delivery chain present
CRITICAL IDS alerts for exploit-kit landing pages and ClickFix C2 DNS/TLS SNI queries
Multi-source threat-intel correlation on loader/exfiltration domains
Page loads multiple flagged third-party script hosts unrelated to the site's therapy content
Domain age information unavailable

Details

Page Title

Caroline Schaay Traumaverwerking en Healing in Friesland – Rediscover your Self > Ontdek je ware potentieel.

Scan Type

public

Domain Name Analysis

You're looking at domain 'carolineschaay.nl' on the Dutch country-code top-level domain (.nl) and has no subdomain. Its registrable label 'carolineschaay' stretches across 14 characters with six vowels and eight consonants. Splitting it apart reveals 4 words: caroline, sch, a, ay. Median word length comes out to 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://carolineschaay.nl/

Page Load Overview

4.79s
Total Load Time
4.8 MB
Total Size

Language Analysis

Primary Language

🇳🇱Dutch
Code: nl
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:nl-NL
Text Length:5,771 chars
Detector Agreement:100%

Website Classification

Primary Category

blog personal website58% confidence
Type: spa
Method: ml+structural

All Detected Categories

blog personal website
58%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4185.104.29.24Netherlands
AS206281Stichting DIGI NL
3142.251.110.95Google · CDNUnited States
AS15169Google LLC
3172.67.187.123Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.251.153.4Google · CDNUnited States
AS15169Google LLC
3216.239.38.178Google · CDNUnited States
AS15169Google LLC
3157.240.0.6Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
3142.251.14.94Google · CDNUnited States
AS15169Google LLC
3142.251.110.97Google · CDNUnited States
AS15169Google LLC
3216.239.32.36Google · CDNUnited States
AS15169Google LLC
9130--

Detected Technologies10

100%
JQueryv3.7.1
100%
100%
Bootstrapv4.17.5
100%
50%
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F4833B32B06D1836205F96DEF0A2B31C626B5225CB536565F3FE826C5BC6DE3317222D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:PF7d9JiAypNPcTNOKKObI1l/WjGt3tbnyeleLKx8eHEx6eXqxZx2X7wii0uKkYwS:PRduBjwiujcbiLwiiqkYwm+e

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:86927:JEigUIDSFwgQMK4ykKFB8BFBSAKkFDwVA6APCAaJgF0WYBQCQiqiER4KKcgoLAqIsQgMFRDQIcmQQKEApy8AYGBUBSRFC2Aj

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffe7b753030000
Perceptual Hash:ace25bc9c8b7c988
Difference Hash:ab8dcfa6b673622b
Wavelet Hash:fff7e74753030200
Color Hash:#4abf40

Scan History

Scan history not available

Unable to load historical scan data