Security Report: check-m5dcuom.devwatchalerts.cyou - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/8d841b2f-28b5-4988-b09a-575c650c04d0 Domain and IP registration (RDAP)/api/v1/rdap/8d841b2f-28b5-4988-b09a-575c650c04d0 Certificate Transparency/api/v1/ct/check-m5dcuom.devwatchalerts.cyou How often this domain was scanned/api/v1/domain/stats/check-m5dcuom.devwatchalerts.cyou Scan history for this domain/api/v1/domain/history/check-m5dcuom.devwatchalerts.cyou?limit=15

This website contacted 6 IPs in 1 country across 6 domains to perform 18 HTTP transactions. The main domain is check-m5dcuom.devwatchalerts.cyou and was registered 3 years ago.

Submitted URL: https://check-m5dcuom.devwatchalerts.cyou/?address=2ZVKH8FpNvmqaFhaH3Apgw1rctNzmfyVRSz4SaFFpump

AI Security Verdict

Low Risk

Confidence: 75%

Risk Score

5-day-old .cyou site flagged for phishing that presses users to connect a wallet to 'unlock' analysis — a wallet-drainer lure. No reputation, unverified but consistent on-domain phishing report. Avoid connecting any wallet.

Risk Factors (5)

Domain registered 5 days ago — extreme phishing window

Single-source phishing report tied to the scanned primary domain

Wallet-connect / unlock gating used to capture user wallet interaction

Unranked domain with no history, masquerading as a 'trusted by top Solana traders' tool

Dynamic function-constructor code generation on a 5-day-old site

Safety Factors (6)

No HTML credential/payment form fields detected (0 password, 0 payment, 0 forms)

No YARA JavaScript malware patterns detected

No cross-origin credential exfiltration detected

Uses public Solana/pump.fun RPC endpoints (mainnet.helius-rpc.com matches are generic abuse-reputation only)

Brand names (Phantom, Jupiter, Raydium) appear as 'trusted by' references, not impersonation

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 8 to 3

Domain age information unavailable

Details

Page Title

DEVWATCH — Analysis: 2ZVKH8Fp...pump

Scan Type

public

Favicon Hash

MMH3: 1051558944

MD5: 2010b80e2ec9ace8f950311195a66d50

Domain Name Analysis

The domain name 'check-m5dcuom.devwatchalerts.cyou' uses the .cyou top-level domain, featuring subdomain 'check-m5dcuom'. Count 14 characters in 'devwatchalerts' with 4 vowels and 10 consonants. Splitting it apart reveals three words: dev, watch, alerts. Median word length comes out to five characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.56s

Total Load Time

425 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:3,021 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software69% confidence

Type: static

Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software

69%

cryptocurrency blockchain

61%

finance banking

45%

corporate

25%

Detected Features

OG: website

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	142.251.127.95Google · CDN	United States	AS15169Google LLC
3	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	172.64.151.87Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.18.34.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	142.251.110.94Google · CDN	United States	AS15169Google LLC
18	6	-	-