ScanMalware.com

Security Scan Report: ovotops1stwin.world

Submitted: Completed: publiccompleted

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Fake Cloudflare verification page running the ClickFix Win+X/PowerShell paste-and-run lure on a domain flagged as 'iclickfix' malware by two feeds, with 19 critical EtherHiding exfiltration IDS alerts. Do not follow its instructions.

Risk Factors (5)
Known ClickFix malware kit (Win+X / PowerShell paste-and-run social engineering) confirmed by high-precision YARA hit
Impersonation of Cloudflare's human-verification UI on a non-Cloudflare domain
Multi-source threat-intelligence match naming this primary domain as 'iclickfix' malware
19 CRITICAL ET MALWARE EtherHiding Exfil M2 IDS alerts indicating command-and-control / exfiltration traffic
Indonesian online-gambling landing page ('SLOT OVO', 'judi slot online', 'Maxwin') used as lure
Domain age information unavailable

Details

Page Title

SLOT OVO — Link Daftar DP 10K SLOT OVO Gampang Maxwin Anti Rungkad Terbaru

Scan Type

public

Domain Name Analysis

The domain name 'ovotops1stwin.world' uses the .world top-level domain. Its registrable label 'ovotops1stwin' stretches across 13 characters holding four vowels versus eight consonants, along with one digit. Word splitting yields five words: ovo, tops, 1, s, twin. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ovotops1stwin.world

Page Load Overview

0.99s
Total Load Time
140 KB
Total Size

Language Analysis

Primary Language

🇮🇩Indonesian
Code: id
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:id
Text Length:1,072 chars
Detector Agreement:60%

Website Classification

Primary Category

technology software74% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
74%
documentation technical
47%
phishing scam
40%
gambling betting
39%
government public service
25%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8104.21.25.54Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.20.132Google · CDNUnited States
AS15169Google LLC
4104.16.79.6Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4172.67.222.247Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
415.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
4104.16.78.6Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
434.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
4172.67.142.245Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
43.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
409--

Detected Technologies5

Cloudflare Bot Management
70%
HTTP/3
40%
Cloudflare
40%
AMP
30%
Lightbox
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T146B27257A58961D85117D32245E2FB7F2D34D8039A324D2EFA0D2B9CCF46B867A3360E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:7Wk5F4g5A4WR2v/p6m41g+pfJz0t9Ekyl+p:7Z5F4g5A4WR2vdH+pfJz0tdv

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:24985:YYhVwKu4CZxKBoEVgaIoHCQRFEAYkxFAOSARGDQAKMJENLxKkjAADgMQJJhYDGdOhEG4FWhJeo4Qq4BTcV+YEQwCIkIFQJhQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000000000181800
Perceptual Hash:9966669966999966
Difference Hash:0000000008303004
Wavelet Hash:ff101000fdfffb00
Color Hash:#ac539c

Other Hashes

Crop Resistant:0000000008303004

Scan History

Scan history not available

Unable to load historical scan data