ScanMalware.com

Security Scan Report: fuelcouncil.ink

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/2d5105e6-e098-49b6-a65c-68694a045859Domain and IP registration (RDAP)/api/v1/rdap/2d5105e6-e098-49b6-a65c-68694a045859How often this domain was scanned/api/v1/domain/stats/fuelcouncil.inkScan history for this domain/api/v1/domain/history/fuelcouncil.ink?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 10 HTTP transactions. The main domain is fuelcouncil.ink and was registered 2 weeks ago.

Submitted URL: https://fuelcouncil.ink/

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Fake Fuel Labs recruitment page running a referral-gated ClickFix kit that pushes a clipboard PowerShell/curl command installing the OverLord stealer. hunting rule + kit roster + HIGH IDS alert confirm malware distribution.

Risk Factors (5)
Known malicious recruitment/ClickFix kit identified by analyst-vetted roster and high-precision hunting rule
Delivers a stealer payload (OverLord) via clipboard-pasted PowerShell/curl commands
Impersonates blockchain company Fuel Labs on a non-official domain (fuelcouncil.ink)
HIGH-severity IDS alert for PowerShell stager traffic
Domain unranked in Cisco Umbrella with no reputation; legitimacy score 8/100
Domain age information unavailable

Details

Page Title

Fuel Execution Lab

Scan Type

public

Domain Name Analysis

The domain 'fuelcouncil.ink' uses the .ink top-level domain without a subdomain. The registrable portion 'fuelcouncil' spans 11 characters with 5 vowels and 6 consonants. Breaking it apart gives two words: fuel, council. Average segment length settles at 5.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

[FUEL Rethink blockchain execution. VIEW MISSIONS Engineers wanted for the hard problems

Page Load Overview

2.29s
Total Load Time
149 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:2,256 chars
Detector Agreement:97%

All Detected Languages

🇺🇸en(95%)🇷🇴ro(3%)🇪🇸ca(2%)

Website Classification

Primary Category

technology software47% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
47%
cryptocurrency blockchain
46%
documentation technical
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10193.160.32.243Nuremberg, Bavaria, Germany
AS206216Advin Services LLC
101--

Detected Technologies2

Ubuntu
40%
Nginxv1.28.3
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T10542DA62A3F52E7320AB81C71CA60B566CF9C117DD981C407BBE8B605FEFC81761761A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:ivRrbP/yzAF3TOAO1F38NZVoO/WKXrC54MTw:8ygDLuMNZVoO/LG0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:12645:YDMEDJFQEA5ACQB4AD40bEGSwwZTCeDcEIqKBwBkEGoYBFagUBJAmyEixQAQCEMGYCDCoJgB9EB0AJgSISQcABAJuIRsONCG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0600796161017d79
Perceptual Hash:c3349c3c33c7ecc1
Difference Hash:94d5c1c9d125c1c9
Wavelet Hash:ff01796161017d79
Color Hash:38000000c00

Other Hashes

Crop Resistant:565656800200200e,94d5c1c9d125c1c9

Scan History

Scan history not available

Unable to load historical scan data