Security Scan: https://48mko9hrqrdwuvj.icu/

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/6e635acb-a044-4ca7-a18e-c747f3e4b5d2 Domain and IP registration (RDAP)/api/v1/rdap/6e635acb-a044-4ca7-a18e-c747f3e4b5d2How often this domain was scanned/api/v1/domain/stats/48mko9hrqrdwuvj.icu Scan history for this domain/api/v1/domain/history/48mko9hrqrdwuvj.icu?limit=15

This website contacted 1 IP in 1 country across 1 domain to perform 28 HTTP transactions. The main domain is 48mko9hrqrdwuvj.icu and was registered 2 weeks ago.

Submitted URL: https://48mko9hrqrdwuvj.icu/

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Confirmed fake captcha page serving the DarkSword iOS exploit chain to install the Coruna wallet stealer, impersonating Cloudflare verification on an 8-day-old .icu domain with multi-feed malware intelligence.

Risk Factors (5)

Known malicious iOS exploit kit (DarkSword / Coruna wallet stealer) confirmed by analyst-vetted kit roster

Fake captcha 'security verification' gate used as exploit delivery vehicle

Multi-source malware threat-intelligence match against the page URL

Brand impersonation of Cloudflare security/verification branding

Domain registered 8 days ago on a .icu TLD with no reputation ranking

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Favicon Hash

MMH3: 572496253

MD5: 23bc5fee50e0961814831e5f9ee791c2

Domain Name Analysis

Domain '48mko9hrqrdwuvj.icu' uses the .icu top-level domain without a subdomain. The core label '48mko9hrqrdwuvj' covers 15 characters split between two vowels and 10 consonants, notching 3 digits. Segmentation suggests 9 words: 48, m, ko, 9, hr, q, rd, wuv, j. Median word length comes out to 2 characters. No strong language cues emerged from the frequency lists.