Security Scan: Morgana Orvokki

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/554461af-9dc1-47df-afa4-31670c86958b Domain and IP registration (RDAP)/api/v1/rdap/554461af-9dc1-47df-afa4-31670c86958bHow often this domain was scanned/api/v1/domain/stats/morganaorvokki.com Scan history for this domain/api/v1/domain/history/morganaorvokki.com?limit=15

This website contacted 9 IPs in 4 countries across 11 domains to perform 50 HTTP transactions. The main domain is morganaorvokki.com and was registered 3 years 8 months ago.

Submitted URL: https://morganaorvokki.com

Effective URL:

https://www.morganaorvokki.com/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 98%

Risk Score

Compromised site serving a fake Cloudflare 'I'm not a robot' page that pastejacks a ClickFix PowerShell command into the clipboard to install the AMOS stealer via a ClearFake EtherHiding loader. Confirmed malware distribution.

Risk Factors (7)

ClickFix clipboard injection of a Windows shell command

Hidden-window PowerShell remote loader staged in page script

ClearFake EtherHiding loader reading next stage from a Polygon smart contract

Macfinger ClickFix / AMOS infostealer kit identified by analyst-vetted roster

Fake Cloudflare 'security review' interstitial impersonating Cloudflare branding

Anti-analysis: DevTools, right-click and view-source blocked; encoding/decoding routines in inline scripts

Obfuscated script hides known-malicious RPC hosts (polygon.drpc.org, 1rpc.io, polygon.gateway.tenderly.co)

Domain age information unavailable

Details

Page Title

Morgana Orvokki

Scan Type

public

Favicon Hash

MMH3: 2144286397

MD5: 388f5b455ced10cdbc4c044e63abdbff

Domain Name Analysis

The domain name 'morganaorvokki.com' uses the commercial generic top-level domain (.com) with no subdomain. The second-level label 'morganaorvokki' is 14 characters long split between 6 vowels and eight consonants. Breaking it apart gives 5 words: morgana, or, v, ok, ki. Average segment length settles at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.45s

Total Load Time

390 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-GB

Text Length:853 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical45% confidence

Type: spa

Method: ml+structural

All Detected Categories

documentation technical

45%

technology software

43%

e-commerce shopping

42%

social media network

34%

adult content

27%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
10	46.30.213.186	Copenhagen, Capital Region, Denmark	AS51468One.com A/S
5	192.178.170.95Google · CDN	United States	AS15169Google LLC
5	171.22.131.23	Cyprus	AS203273NetCrafters OU
5	192.0.76.3	San Francisco, California, United States	AS2635Automattic, Inc
5	172.66.146.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	142.251.14.94Google · CDN	United States	AS15169Google LLC
5	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
5	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	142.251.20.139Google · CDN	United States	AS15169Google LLC
50	9	-	-