Security Scan: nillion

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/032d3535-e1f2-4b10-9931-ab8c565dda48 Domain and IP registration (RDAP)/api/v1/rdap/032d3535-e1f2-4b10-9931-ab8c565dda48How often this domain was scanned/api/v1/domain/stats/nillion-voting.pages.dev Scan history for this domain/api/v1/domain/history/nillion-voting.pages.dev?limit=15

This website contacted 13 IPs in 3 countries across 8 domains to perform 9 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://nillion-voting.pages.dev/

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Fake Nillion voting/airdrop page on pages.dev using obfuscated scripts, ClearFake-linked infrastructure and EtherHiding blockchain exfiltration flagged by critical IDS alerts — brand impersonation plus malware distribution.

Risk Factors (6)

Brand impersonation of Nillion on an unrelated pages.dev subdomain

Obfuscated JavaScript concealing threat-feed blockchain RPC hosts

4 CRITICAL IDS malware alerts (ET MALWARE EtherHiding Exfil M2)

Page JavaScript contacts a domain reported as the ClearFake malware family

Blockchain RPC fetches combined with impersonation and a token/reward lure — wallet-drainer delivery pattern

Free shared-hosting subdomain with unknown creation date

Domain age information unavailable

Details

Page Title

nillion

Scan Type

public

Domain Name Analysis

The domain 'nillion-voting.pages.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'nillion-voting'. The registrable portion 'pages' spans 5 characters holding two vowels versus 3 consonants. Segmentation suggests one word: pages. The median word length lands at 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.86s

Total Load Time

1.8 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:555 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical95% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

documentation technical

95%

technology software

91%

news media journalism

66%

government public service

58%

cryptocurrency blockchain

34%

Detected Features

OG: website

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
9	172.66.44.96Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	172.66.47.160Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	54.155.153.118Aws · CLOUD	Dublin, Leinster, Ireland	AS16509Amazon.com, Inc.
0	108.133.212.217Aws · CLOUD	Dublin, Leinster, Ireland	AS16509Amazon.com, Inc.
0	172.67.72.107Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	172.66.150.162Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	104.16.249.249Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	8.8.4.4Google · CDN	Westfield, Massachusetts, United States	AS15169Google LLC
0	45.9.149.116	Amsterdam, North Holland, Netherlands	AS49447Nice IT Services Group Inc.
0	104.16.248.249Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
9	13	-	-