Scan report · about 1 month agoPublic

www.valeriedalleur.com

188.165.53.185AS16276 · FR

Submittedhttps://www.valeriedalleur.com/

page reads command-and-control from a blockchain node while presenting no crypto context (rpc-mainnet.matic.quiknode.pro, polygon.gateway.tenderly.co)

Engine tags

EtherHidingClickFix

Verdict

3 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 14.3 s · 29 requests

01 · Visitor openswww.valeriedalleur.com

02 · Page shown

STORM2U – Valerie Dalleur

03 · OutcomeThe visitor runs the payload themselvesPaste, Enter — no download and no login form for a filter to catch.

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

fd84bcac-4225-46f7-b586-164887241a4f.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 9aef7f6257ecb262ddafe6bd470258551f90290eab21121c5932af9c7d732d76

InfoCross-domain scripts injected at runtime

3 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 188.165.53.185OVH - OVH SAS, FR · AS16276FR
TLS: CN=YE1, O=Let's Encrypt, C=US · expires Nov 2, 2026

WHOIS

Registrar: OVH sas
Created: Dec 17, 2020
Expires: Dec 17, 2026
Nameservers: dns19.ovh.netns19.ovh.net

62 malicious11 suspicious

Hashes & fingerprints

Page Hash3e017892c2e9d7966d8c1c02f21d3ac39c42ec40c55996a4a0a1bc60cd33b48d Favicon Hash7cde67d3ee1318ae73e23c46bbc337e708ba70ffa9d2d50361f9e5f2f1178598 DOM Hashf632fed53ed0c79baf670e2fb619013514f0ad5467bba4b35058c349b1425b85 Screenshot pHashbf3ec0c08f89311f JARM28d28d28d00028d00042d42d000000aa5feb68b57d31b6dc713b6917a988e3 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintAFED14BD5574DDEE2D443092E66B4A0A196EEECA Cert IssuerCN=YE1, O=Let's Encrypt, C=US

Page capture

Live

Title “STORM2U – Valerie Dalleur”

Visit Site

Engines

7 · time to verdict