Security Scan: Legend Cup

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/7483544c-3204-43dc-b681-75c1cb032540 Domain and IP registration (RDAP)/api/v1/rdap/7483544c-3204-43dc-b681-75c1cb032540 Certificate Transparency/api/v1/ct/legendcup.net How often this domain was scanned/api/v1/domain/stats/legendcup.net Scan history for this domain/api/v1/domain/history/legendcup.net?limit=15

This website contacted 14 IPs in 2 countries across 14 domains to perform 110 HTTP transactions. The main domain is legendcup.net and was registered 18 years ago.

Submitted URL: https://www.legendcup.net/

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Legitimate 4-year-old martial-arts tournament site that has been compromised: injected ClickFix fake 'Cloudflare verification' overlay (Win+X -> Terminal paste) and ErrTraffic/Exvicy loader, with EtherHiding blockchain exfiltration. Do not interact.

Risk Factors (6)

Known malicious ClickFix/EtherHiding PHP/JS injected into the page (two roster-anchored CRITICAL YARA rules)

Fake Cloudflare 'Human Verification' social-engineering overlay instructing users to paste attacker clipboard content into Windows Terminal

PRIMARY DOMAIN flagged as clearfake/iclickfix malware by multiple feeds (misp.scanmalware.com, threatfox.abuse.ch)

Six additional 2-3 feed 'ek clearfake-1' malicious domains loaded as third-party resources

Outbound connections to blockchain RPC nodes consistent with EtherHiding / EtherHiding exfiltration

Hidden Russian-language darknet-mirror (Kraken) SEO text injected into the page

Domain age information unavailable

Details

Page Title

Legend Cup

Scan Type

public

Domain Name Analysis

You're looking at domain 'www.legendcup.net' on the network infrastructure generic top-level domain (.net); it also runs on subdomain 'www'. Count 9 characters in 'legendcup' holding 3 vowels versus six consonants. Breaking it apart gives two words: legend, cup. Median word length comes out to 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

31.24s

Total Load Time

4.2 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:24,561 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical54% confidence

Type: spa

Method: ml+structural

All Detected Categories

documentation technical

54%

technology software

54%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
19	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	150.136.141.142Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
7	104.21.3.152Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	142.251.152.119Google · CDN	United States	AS15169Google LLC
7	104.26.5.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
7	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	172.67.130.228Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	142.251.151.119Google · CDN	United States	AS15169Google LLC
7	172.67.70.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
110	14	-	-