Security Scan Report: sol-twint.icu

Submitted: Completed: publiccompleted
This website contacted 10 IPs in 2 countries across 8 domains to perform 155 HTTP transactions. The main domain is sol-twint.icu and was registered 4 months ago.

Submitted URL: https://sol-twint.icu/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Fake Polymarket prediction-market site running an analyst-identified Solana wallet drainer kit; CRITICAL hunting-rule hit, brand impersonation on an unranked .icu domain, and HIGH IDS alerts. Do not connect a wallet.

Risk Factors (6)
Known malicious crypto wallet drainer kit identified by analyst-vetted roster and CRITICAL hunting rule
Impersonation of the Polymarket brand on a non-official domain
Unranked domain claiming a major brand
Suspicious .icu TLD flagged by network IDS (DNS, TLS SNI, HTTP POST)
Obfuscated inline scripts using encoding/decoding functions
Recent registration (147 days) with no reputation history
Domain age information unavailable

Details

Page Title

Polymarket | The World's Largest Prediction Market™

Scan Type

public

Domain Name Analysis

The domain name 'sol-twint.icu' uses the .icu top-level domain and has no subdomain. The registrable portion 'sol-twint' spans 9 characters with two vowels and six consonants, along with one hyphen. It segments into three words: sol, twin, t. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://sol-twint.icu/

Page Load Overview

2.12s
Total Load Time
5.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:17,942 chars
Detector Agreement:100%

Website Classification

Primary Category

cryptocurrency blockchain83% confidence
Type: spa
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
83%
adult content
65%
news media journalism
62%
entertainment media
47%
gambling betting
47%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
20188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1516.15.38.136Aws · CLOUDBoardman, Oregon, United States
AS16509Amazon.com, Inc.
153.163.248.4Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
15157.240.0.6Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
15142.251.110.95Google · CDNUnited States
AS15169Google LLC
1535.190.43.134Google · CDNKansas City, Missouri, United States
AS396982Google LLC
15188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
15104.20.25.234Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1552.218.169.224Aws · CLOUDBoardman, Oregon, United States
AS16509Amazon.com, Inc.
15142.251.20.95Google · CDNUnited States
AS15169Google LLC
15510--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BF656E2023101B7A966B01DDB9F67F6E91DA5269DBB69C88D3ECC14123C7CB6CE138D4

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:sWVLIrrFaHoivfuzBfhZsSruOSB4tsShA7wzOTuYzQNjrZ8HX2RwkixMff1PF5Zp:ZLIrrFaHoivSNw41xQA1PFqql54e

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1420776:AoCKCIBEYCBHKwBPBb04PENQAENnQxCDFiAWA1QiMBEBA4kyiCcuhQGEPAFCEAzKSCMB4EC0nQWARRkVuEDAjkACmglaYVjm

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:dbc3c2ffff420018
Perceptual Hash:b0966b61cb367493
Difference Hash:33158eaa8a969471
Wavelet Hash:dbc342ffff420018
Color Hash:#40acbf

Scan History

Scan history not available

Unable to load historical scan data