Security Scan Report: christiancordero.mba

Site favicon
Submitted: Completed: publiccompleted
This website contacted 12 IPs in 1 country across 7 domains to perform 61 HTTP transactions. The main domain is christiancordero.mba and was registered 5 years ago.

Submitted URL: https://christiancordero.mba

AI Security Verdict

Confirmed Scam

Confidence: 94%

9
Risk Score

Legitimate Puerto Rico real-estate agent site that has been compromised and injected with a ClickFix fake-CAPTCHA/Terminal lure; YARA, IDS and multi-feed malware Indicators of Compromise confirm a malicious overlay.

Risk Factors (5)
Injected ClickFix fake-CAPTCHA overlay impersonating Cloudflare verification ('Ray ID', 'Performance and Security by Cloudflare')
Clipboard-based Windows LOLBin/PowerShell execution lure (Win+X -> Terminal -> Ctrl+V -> Enter)
CRITICAL and HIGH YARA phishing-kit detections on the page body
Repeated CRITICAL ET MALWARE EtherHiding Exfil network alerts
Multi-feed malware Indicators of Compromise for the primary domain and URL
Domain age information unavailable

Details

Page Title

Christian Cordero

Scan Type

public

Domain Name Analysis

Within the .mba top-level domain, 'christiancordero.mba' is registered with no subdomain. Its registrable label 'christiancordero' stretches across 16 characters split between 6 vowels and ten consonants. It segments into 3 words: christian, corder, o. Median word length is six characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://christiancordero.mba

Page Load Overview

1.52s
Total Load Time
1.5 MB
Total Size

Language Analysis

Primary Language

🇪🇸Spanish
Code: es
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:es-PR
Text Length:2,498 chars
Detector Agreement:100%

Website Classification

Primary Category

real estate property95% confidence
Type: static
Method: ml+structural

All Detected Categories

real estate property
95%
blog personal website
72%
government public service
38%
documentation technical
29%
technology software
28%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6172.67.189.238Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.127.95Google · CDNUnited States
AS15169Google LLC
5104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.110.94Google · CDNUnited States
AS15169Google LLC
5104.21.10.46Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.20.95Google · CDNUnited States
AS15169Google LLC
5142.251.13.94Google · CDNUnited States
AS15169Google LLC
53.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
534.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
5172.67.142.245Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
6112--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T116B3855BAAB310765823B57C37EF67497365A003C909CD187EDC53448FCABB499A2B8C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:L4UPhjAgI+SBHvFaLdXnnOO9yhWhR2Oddv:VhW6v

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:107505:UAAcMIgRRNoCACsAgMAxDJHMkQRjDK1xMotTAYKgcEhQMM0eTcFoIMAFMKgQDYRRCBYmVAIgAugDOAARA8g2ATg0AIiBYggC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:003810101c007e7e
Perceptual Hash:826d833b966936d3
Difference Hash:c9e1f1b1f939d0cc
Wavelet Hash:003819193d1d7f7f
Color Hash:#7994d2

Scan History

Scan history not available

Unable to load historical scan data