Security Report: www.nicociucci.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/2613a96f-ab48-4a0f-a280-0657b7f7f5af Domain and IP registration (RDAP)/api/v1/rdap/2613a96f-ab48-4a0f-a280-0657b7f7f5af Certificate Transparency/api/v1/ct/nicociucci.com How often this domain was scanned/api/v1/domain/stats/nicociucci.com Scan history for this domain/api/v1/domain/history/nicociucci.com?limit=15

This website contacted 12 IPs in 3 countries across 9 domains to perform 107 HTTP transactions. The main domain is nicociucci.com and was registered 18 years ago.

Submitted URL: https://www.nicociucci.com

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Legitimate game-designer portfolio compromised and injected with a ClickFix Win+X Terminal overlay plus EtherHiding blockchain loader; primary domain flagged as malware and multiple CRITICAL IDS alerts confirm active malware distribution.

Risk Factors (6)

Injected ClickFix 'Human Verification' overlay coaxing visitors into pasting attacker PowerShell into Windows Terminal (executes malware)

Two CRITICAL roster-anchored YARA kit detections for clickfix-winx-overlay-2026-10

EtherHiding: malicious loader resolves its payload host from a blockchain smart contract to evade takedown

Indicators of Compromise on the primary domain itself ('clearfake'/'unknown loader') and on the resource IP 178.16.52.101:443 ('ek clearfake')

Multiple CRITICAL IDS alerts for ClickFix C2/domain and EtherHiding exfiltration

Hidden gambling/casino SEO spam text ('zumospin bonus code', 'glory casino', 'honeybetz') unrelated to the site's game-design content, indicating compromise and injected spam

Domain age information unavailable

Details

Page Title

nicociucci.com – Game Designer

Scan Type

public

Favicon Hash

MMH3: -500514158

MD5: 189526a7f9628d74f84941182b661c7c

Domain Name Analysis

You're looking at domain 'www.nicociucci.com' on the commercial generic top-level domain (.com) with subdomain 'www'. The second-level label 'nicociucci' is 10 characters long with five vowels and 5 consonants. Segmentation suggests three words: nico, ciuc, ci. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

7.18s

Total Load Time

10.2 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:it-IT

Text Length:2,625 chars

Detector Agreement:75%

Language mismatch: Declared as it-IT but detected as en

Website Classification

Primary Category

technology software47% confidence

Type: spa

Method: ml+structural

All Detected Categories

technology software

47%

documentation technical

29%

entertainment media

26%

corporate

25%

Detected Features

Articles

OG: website

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
19	217.64.195.242	Frosinone, Lazio, Italy	AS12637SEEWEB s.r.l.
8	142.251.20.95Google · CDN	United States	AS15169Google LLC
8	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
8	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
8	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
8	172.67.209.248Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
8	142.251.14.94Google · CDN	United States	AS15169Google LLC
8	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
8	104.21.95.226Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
8	172.66.164.193Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
107	12	-	-