Security Scan Report: www.ipivot.it

Site favicon
Submitted: Completed: publiccompleted
This website contacted 28 IPs in 5 countries across 13 domains to perform 102 HTTP transactions. The main domain is ipivot.it and was registered 6 years ago.

Submitted URL: https://www.ipivot.it

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Legitimate Italian company site that appears compromised: HTML carries a CRITICAL ClickFix/AMOS stealer loader, scripts pull from TA2726 TDS domains, and darknet/pharma spam is injected. Visitors risk macOS malware — avoid.

Risk Factors (5)
Injected first-stage ClickFix/AMOS stealer loader in the page HTML (analyst-vetted kit roster match, CRITICAL)
Multiple CRITICAL IDS alerts for exploit-kit TDS traffic and AMOS loader retrieval
Four unranked third-party script hosts reported as malware/TA2726 TDS, three of them multi-feed corroborated
Spam content injected into the site's news section (darknet marketplace links, pharmaceutical spam) indicating compromise
Obfuscated external XHR/beacon endpoints (quiet-orbit-zephyr-tie.pro) unrelated to the stated business
Domain age information unavailable

Details

Page Title

Ipivot Home - IPivot Technology

Scan Type

public

Domain Name Analysis

Domain 'www.ipivot.it' uses the Italian country-code top-level domain (.it) and includes subdomain 'www'. Count 6 characters in 'ipivot' split between 3 vowels and three consonants. Word splitting yields 2 words: i, pivot. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://www.ipivot.it

Page Load Overview

6.87s
Total Load Time
3.2 MB
Total Size

Language Analysis

Primary Language

🇮🇹Italian
Code: it
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:it-IT
Text Length:6,716 chars
Detector Agreement:50%

Website Classification

Primary Category

healthcare medical86% confidence
Type: spa
Method: ml+structural

All Detected Categories

healthcare medical
86%
technology software
78%
documentation technical
66%
adult content
43%
government public service
35%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2189.46.106.63Arezzo, Tuscany, Italy
AS31034Aruba S.p.A.
3142.251.127.95Google · CDNUnited States
AS15169Google LLC
363.185.90.13Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
3104.21.31.190Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.248.202.189Amsterdam, North Holland, Netherlands
AS14061DigitalOcean, LLC
345.145.14.8Stockholm, Stockholm County, Sweden
AS210644Aeza Group LLC
32.58.65.235Frankfurt am Main, Hesse, Germany
AS44051Fornex Hosting S.L.
3142.251.156.119Google · CDNUnited States
AS15169Google LLC
3172.67.179.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10228--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T10A442A3163704462E7677EDBC904AF08A02BD353E6432BC4A8ECD2597ED9DAD8753329

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:k6whclkl5dZQ4sZ8bXemlUVugymjwvXM+xK6JDShYx+pHT45D5HUnG45Ct:hYclk7dV5heEx5o/Ct

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:272330:hYBnONZI46LETIuCKUlihARBABIKgTOiWwhFARIEFgEQUGssJMYqwhAEAFdAABtA1cEAyAhOjIoFSnCokdxBiKkUBdOTxnwL

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:b9cfcfc7c7c3ffff
Perceptual Hash:b319cc463b3b46cc
Difference Hash:6318181c0c0c0000
Wavelet Hash:b0ceccc4c2c2f2f2
Color Hash:#79b3d2

Other Hashes

Crop Resistant:6318181c0c0c0000

Scan History

Scan history not available

Unable to load historical scan data