Security Report: gffworks.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/4c8c86c1-588b-4cc1-8875-c21944c6b16b Domain and IP registration (RDAP)/api/v1/rdap/4c8c86c1-588b-4cc1-8875-c21944c6b16bHow often this domain was scanned/api/v1/domain/stats/gffworks.com Scan history for this domain/api/v1/domain/history/gffworks.com?limit=15

This website contacted 16 IPs in 3 countries across 11 domains to perform 47 HTTP transactions. The main domain is gffworks.com and was registered 11 years ago.

Submitted URL: https://gffworks.com

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Compromised/repurposed site serving a ClickFix fake 'Human Verification' overlay backed by EtherHiding smart-contract infrastructure; YARA kit match plus 10 CRITICAL malware IDS alerts. Do not interact.

Risk Factors (6)

Known malicious ClickFix/EtherHiding kit injected into the page (YARA-verified)

Multiple CRITICAL IDS alerts for malware exfiltration and exploit-kit check-in traffic

Page pulls scripts from domains with corroborated malicious reputation (jscdncloude.beer, javascript.skin, interseq.at)

Blockchain RPC lookups (Polygon, tenderly, 1rpc, ankr) used to resolve the overlay host from a smart contract

Fake Cloudflare/'Human Verification' overlay instructing visitors to open Windows Terminal and run commands

Threat-intel hit on the primary domain itself, indicating the legitimate-looking site is compromised or repurposed

Domain age information unavailable

Details

Page Title

Gffworks – Unleash Full Potential

Scan Type

public

Favicon Hash

MMH3: -434950183

MD5: 0edda4f9302ec961cc94532170da3567

Domain Name Analysis

The domain 'gffworks.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. Count 8 characters in 'gffworks' holding 1 vowel versus 7 consonants. Splitting it apart reveals three words: g, ff, works. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

8.75s

Total Load Time

3.6 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:5,642 chars

Detector Agreement:100%

Website Classification

Primary Category

blog personal website82% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

blog personal website

82%

gambling betting

74%

technology software

66%

government public service

53%

social media network

51%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
17	74.208.236.228	United States	AS8560IONOS SE
2	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
2	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
2	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
2	104.21.3.152Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.154.120Google · CDN	United States	AS15169Google LLC
2	104.26.4.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.21.85.117Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
47	16	-	-