ScanMalware.com

Security Scan Report: gadnkeepero.ink

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/066f600d-aeb3-4c54-8041-6826ad42ea4eDomain and IP registration (RDAP)/api/v1/rdap/066f600d-aeb3-4c54-8041-6826ad42ea4eHow often this domain was scanned/api/v1/domain/stats/gadnkeepero.inkScan history for this domain/api/v1/domain/history/gadnkeepero.ink?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 4 HTTP transactions. The main domain is gadnkeepero.ink and was registered 1 month ago.

Submitted URL: https://gadnkeepero.ink/

AI Security Verdict

Confirmed Scam

Confidence: 88%

10
Risk Score

Credential login page on gadnkeepero.ink, a primary domain flagged in threat intelligence as Lazarus APT malware; the 'Cortex' console branding does not match the hostname. Do not enter credentials.

Risk Factors (5)
Primary domain matched in threat intelligence as Lazarus APT malware (single-source, unverified)
Credential login form (username + password) on a domain with a malware indicator
Apparent mismatch between self-declared 'Cortex' console branding and the gadnkeepero.ink hostname
No domain reputation / not in Cisco Umbrella top 1M
No third-party resources or verifiable organizational information on the page
Domain age information unavailable

Details

Page Title

Cortex — Node Management Console

Scan Type

public

Domain Name Analysis

Domain 'gadnkeepero.ink' uses the .ink top-level domain. The core label 'gadnkeepero' covers 11 characters split between 5 vowels and 6 consonants. Segmentation suggests four words: gad, n, keeper, o. Expect 2 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Cortex Node Management Console USERNAME Usemame (e.g. admin) PASSWORD Enter password > Legacy token login

Page Load Overview

2.47s
Total Load Time
172 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:108 chars
Detector Agreement:90%

All Detected Languages

🇺🇸en(86%)🇫🇷fr(14%)

Website Classification

Primary Category

cryptocurrency blockchain58% confidence
Type: static
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
58%
technology software
51%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4207.241.172.222Nuremberg, Bavaria, Germany
AS206216Advin Services LLC
41--

Detected Technologies4

Node.js
50%
Ubuntu
40%
Nginxv1.24.0
40%
Express
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12311351458D18E194307895064C0E948394BD70BC31A5A0432BCCAEC6BFAED38F334F9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:njCTToqLVrH7EApXbMO8J8fcNUjQ6CNR0w:nqoql7dbnMh6Cfv

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1068:ACCAEAQAAAAAAAAAAAAABAgAAAABAAAABSAAAAAAAQAQAQACAAAAIAAAAQAgAkAAAAIAAACECAhAACAAAAIAAAAAAAAAAIgA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000181818180000
Perceptual Hash:cc663399cc669999
Difference Hash:0008303032320c00
Wavelet Hash:0000181818180000
Color Hash:38001000030

Other Hashes

Crop Resistant:0008303032320c00

Scan History

Scan history not available

Unable to load historical scan data