Security Report: nicolas3007.online - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/fe8a38c7-a632-48e4-86fb-68e9f50fa81b Domain and IP registration (RDAP)/api/v1/rdap/fe8a38c7-a632-48e4-86fb-68e9f50fa81bHow often this domain was scanned/api/v1/domain/stats/nicolas3007.online Scan history for this domain/api/v1/domain/history/nicolas3007.online?limit=15

This website contacted 9 IPs in 1 country across 9 domains to perform 82 HTTP transactions. The main domain is nicolas3007.online and was registered 3 years 5 months ago.

Submitted URL: https://nicolas3007.online

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Legitimate-looking balloon business site compromised and serving an injected EtherHiding/ClickFix malware loader; critical YARA kit hit plus 5 CRITICAL IDS alerts make this CONFIRMED malicious.

Risk Factors (5)

Critical YARA match for a known ClickFix 'Human Verification' overlay malware kit injected into the page

EtherHiding: script fetches its next-stage payload address from a Polygon smart contract

Obfuscated script hiding threat-feed hosts (1rpc.io, polygon.drpc.org, polygon.gateway.tenderly.co) visible only after decoding

5 CRITICAL Suricata malware alerts (EtherHiding exfil, ClickFix C2 domain queries)

Primary domain and third-party resources corroborated as malware/exploit-kit infrastructure across multiple threat feeds

Domain age information unavailable

Details

Page Title

Aux Jolys Ballons 2.0 – Boutique spécialisée en montage de ballons, articles de fête en tout genre & cadeaux originaux.

Scan Type

public

Favicon Hash

MMH3: 191409928

MD5: b83e09faf13fc2134c13cba4fec4e621

Domain Name Analysis

You're looking at domain 'nicolas3007.online' on the modern generic top-level domain (.online) and has no subdomain. The second-level label 'nicolas3007' is 11 characters long split between three vowels and 4 consonants, notching four digits. Word splitting yields 2 words: nicolas, 3007. Median word length comes out to 5.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

9.31s

Total Load Time

2.9 MB

Total Size

Language Analysis

Primary Language

🇫🇷French

Code: fr

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:fr-FR

Text Length:5,832 chars

Detector Agreement:100%

Website Classification

Primary Category

news/blog40% confidence

Type: spa

Method: structural

All Detected Categories

news/blog

40%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
10	194.11.214.53	Asheville, North Carolina, United States	AS47583Hostinger International Limited
9	192.178.183.95Google · CDN	United States	AS15169Google LLC
9	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	142.251.20.94Google · CDN	United States	AS15169Google LLC
9	104.26.5.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	104.17.25.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
9	172.67.130.228Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
82	9	-	-