Scan report · 2 months agoPublic

www.guvenceliotoelektrik.com

88.99.106.172AS24940 · DE

Submittedhttps://www.guvenceliotoelektrik.com/

page copied a hidden download-execute command to the visitor's clipboard (ClickFix)

Engine tags

Verdict

2 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 9.3 s · 2 requests

01 · Visitor openswww.guvenceliotoelektrik.com

02 · Page shown

Güvenceli Oto Elektrik - Maintenance mode.

03 · Clipboard seeded · hiddenA command the visitor never seesdownload-executeThe text is under findings, behind a warning. It was never run.

04 · OutcomeThe visitor runs the payload themselvesPaste, Enter — no download and no login form for a filter to catch.

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

ClickFixSilent clipboard commanddownload-execute

The page never showed this command to the visitor — it silently placed it on their clipboard and instructed them to paste and run something they could not read. The victim executes the attacker's payload themselves; no download or login form is needed.

Our probe obtained it by pressing the fake verification widget on a throwaway copy of the page — the page did not hand it over on load.

Live attacker command — do not run this

This is the exact text the page silently placed on a visitor's clipboard. Pasting it into the Windows Run dialog (Win+R), PowerShell, or any terminal will execute the attacker's payload on your machine. Urlyze captured it inside an isolated browser and never executed it.

File

The file was not analysed, so the scan carries no verdict on the file itself.

Infrastructure

IP: 88.99.106.172HETZNER-AS - Hetzner Online GmbH, DE · AS24940DE
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Oct 10, 2026

WHOIS

Registrar: Cizgi Telekomunikasyon A.S.
Created: Feb 3, 2023
Expires: Feb 3, 2027
Nameservers: ns13.hostlab.net.trns14.hostlab.net.tr

43 malicious5 suspicious

Hashes & fingerprints

Page Hash23f4cfb6e07433c63fdad564a28076cbbfad2025fae9b9f106b15569fd8236dd DOM Hashee2a433f8e7df43e42598eea9fc1614387aac9bac832f64cd3aad0395a0574d3 Screenshot pHash88db3366cc993366 JARM29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintF40BDFE9D1DA95FAE1868543D8FFF58610684AC0 Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

Title “Güvenceli Oto Elektrik - Maintenance mode.”

Visit Site

Engines

7 · time to verdict