Scan report · 27 days agoPublic

focustaepperoggulve.dk

77.111.240.251AS51468 · DK

Submittedhttps://focustaepperoggulve.dk

Landed onhttps://focustaepperoggulve.dk/

Verdict

2 of 9 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

7459aa18-df10-451c-9cba-635eeb527311.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 837e98e8331cc9d0a39dde9a27b5070c96896b3e1e54ca7dee839217fc8232af

SupportingDecoded-then-executed payload

Script on the page base64-decoded a blob and immediately ran it (decode → eval) — a classic way to hide an obfuscated payload from static inspection.

Analyst noteAlmost always obfuscation. Check the suspicious-script evidence panel for the decoded snippet.

InfoBrand impersonation detected

Meta · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime

2 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 77.111.240.251ONECOM - One.com A/S, DK · AS51468DK
TLS: CN=YE1, O=Let's Encrypt, C=US · expires Nov 10, 2026
Redirects: 0 hops · / → /

40 malicious7 suspicious

Hashes & fingerprints

Page Hashb6456eb68fb3f6aee50dc5e0a39a0a1fa27dc25ce529eb3e45563a3972e775c3 Favicon Hash8e2a1af325628752f94820d28a1284e439300ddc54c13aaf87e02811ae7f9437 DOM Hashbf406b297435e757477bfe628479078c0b1df93e8e715afce9e5cc4dff1eae47 Screenshot pHash9db468b5d9891cc9 JARM27d40d40d00000000042d43d0000000f0fc3b7e99fa90f0a6ea06fe65aef1d JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintC1FD7FF017C602F4FFFF9F161827B8A2516C897A Cert IssuerCN=YE1, O=Let's Encrypt, C=US

Page capture

Live

Title “Focus Tæpper & Gulve | Alt i tæpper, gulve og gardiner” · brand shown: Meta (low)

Visit Site

Engines

9 · time to verdict