Security Scan Report: zeus125pmi.cyou

Site favicon
Submitted: Completed: publiccompleted
This website contacted 10 IPs in 2 countries across 7 domains to perform 58 HTTP transactions. The main domain is zeus125pmi.cyou and was registered 8 months ago.

Submitted URL: https://zeus125pmi.cyou/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Fake Cloudflare 'verify you are human' page using clipboard pastejacking to push a PowerShell command, backed by 20 critical IDS malware alerts and a malware threat-intel hit. Malware delivery — do not interact.

Risk Factors (6)
Clipboard shell injection (ClickFix) delivering a PowerShell command
20 critical IDS malware alerts (EtherHiding exfiltration)
Impersonation of Cloudflare's verification UI
Threat-intel malware match on the scanned URL and on a loaded third-party resource
Six cross-domain redirects and an off-site gambling funnel
Unranked domain with illegal-gambling landing content
Domain age information unavailable

Details

Page Title

ANGKASA138 : Situs Minimal Deposit 10K Terbaru Gampang Menang JACKPOT!

Scan Type

public

Domain Name Analysis

Domain 'zeus125pmi.cyou' uses the .cyou top-level domain with no subdomain. Its registrable label 'zeus125pmi' stretches across 10 characters holding 3 vowels versus 4 consonants, notching 3 digits. Word splitting yields 4 words: zeus, 125, pm, i. The median word length lands at 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://zeus125pmi.cyou/

Page Load Overview

2.66s
Total Load Time
542 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-ID
Text Length:1,079 chars
Detector Agreement:50%

Website Classification

Primary Category

technology software76% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
76%
gambling betting
63%
documentation technical
54%
phishing scam
32%
government public service
32%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
13104.21.38.245Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5142.251.14.132Google · CDNUnited States
AS15169Google LLC
5172.67.141.37Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
515.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
534.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
5172.67.142.245Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
53.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
587.250.251.119Yandex · CLOUDRussia
AS13238YANDEX LLC
577.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
587.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
5810--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17D836126B995203E61D7837D2556F33A3E38E037D250DDE9BE9CB364CF8138A6871208

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:RZ5F4g5A4WR2vXNrVXYhZoWkw8FUrAtydSMPUJ7I:d6ZoWMqAtyUD0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:85428:XBoEggEIN3QACsBwKVCwQAELMiywRgKwpB9ICK6KTARQwUENhAo1ABSgYwVxSBVKBRwoIDUSgrg0iQQDEGzIwBTAyVKyYoEC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:cfc3c3ffffffffe7
Perceptual Hash:b03930cfc6cec6cc
Difference Hash:189a16100000100c
Wavelet Hash:2f030f0f0f0f0f03
Color Hash:#5b3a78

Other Hashes

Crop Resistant:189a16100000100c

Scan History

Scan history not available

Unable to load historical scan data