Security Scan Report: magoproject.com

Submitted: Completed: publiccompleted
This website contacted 8 IPs in 5 countries across 8 domains to perform 30 HTTP transactions. The main domain is magoproject.com and was registered 3 years 4 months ago.

Submitted URL: https://magoproject.com

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Legitimate-looking aged domain compromised and serving the Macfinger ClickFix AMOS stealer: critical YARA + kit-roster hits, a critical AMOS IDS alert, and malware hosts hidden in obfuscated script. Do not visit.

Risk Factors (6)
Known macOS infostealer (AMOS) ClickFix campaign kit hosted on the page
Critical YARA rule match for the ClickFix bot-protection loader first stage
Critical IDS alert for AMOS loader script request
Threat-feed malware domains concealed inside obfuscated JavaScript
Compromised site repurposed as multi-language gambling SEO spam that injects the loader
Unranked external script hosts contacted via sendBeacon/fetch
Domain age information unavailable

Details

Page Title

Just a moment...from scan record

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'magoproject.com' is registered. The core label 'magoproject' covers 11 characters holding 4 vowels versus seven consonants. Splitting it apart reveals 3 words: m, ago, project. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://magoproject.com

Page Load Overview

1.35s
Total Load Time
3.0 MB
Total Size

Language Analysis

Primary Language

🇵🇱Polish
Code: pl
Confidence:20%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:es
Text Length:5,242 chars
Detector Agreement:50%
Language mismatch: Declared as es but detected as pl

Website Classification

Primary Category

gambling betting87% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

gambling betting
87%
education learning
65%
entertainment media
61%
finance banking
53%
technology software
51%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
9147.93.88.251Paris, Île-de-France, France
AS47583Hostinger International Limited
3142.251.110.95Google · CDNUnited States
AS15169Google LLC
3193.29.224.97Helsinki, Uusimaa, Finland
AS210644Aeza Group LLC
3185.92.183.208Riga, Riga, Latvia
AS56971Cgi Global Limited
3157.240.0.35Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
3142.251.127.84Google · CDNUnited States
AS15169Google LLC
33.167.230.19Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
3142.251.14.94Google · CDNUnited States
AS15169Google LLC
308--

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18DC20831E0E448777B0E47EDC1E1732CF9ADA924AA41E67670F9B16416E0DF700B625E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:hv4xszE0yd43ZdqZUaAekWHTKvNfvNvWZiH0oDR5vYDSY8N5cLavNXvN4vNzvNza:F4x/07ZdapNHM9/vIcFoRZa

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:27789:AIgS6A9YBFglBITSEjB3BBNECVDgg4wBFhhBKqQguNkCEVIAhQXQAhLOHwIAI8CEBQ0QvhKlcAYQA9Cesgi6KggIoGVhrgwm

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff0f0f1f0f0f1f0f
Perceptual Hash:99d1e0e6e2c4f1cc
Difference Hash:c83ab83c7b1e7479
Wavelet Hash:7f0f020f0b0f1f0f
Color Hash:#8c40bf

Other Hashes

Crop Resistant:c83ab83c7b1e7479

Scan History

Scan history not available

Unable to load historical scan data