Security Report: kamataticket.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/9089e7d7-c9dc-4b42-9751-8cf213898e02 Domain and IP registration (RDAP)/api/v1/rdap/9089e7d7-c9dc-4b42-9751-8cf213898e02How often this domain was scanned/api/v1/domain/stats/kamataticket.com Scan history for this domain/api/v1/domain/history/kamataticket.com?limit=15

This website contacted 15 IPs in 2 countries across 13 domains to perform 82 HTTP transactions. The main domain is kamataticket.com and was registered 9 months ago.

Submitted URL: https://kamataticket.com

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Confirmed malicious ClickFix/EtherHiding page: fake maintenance/Cloudflare verification lures users into pasting PowerShell commands; primary domain flagged as clearfake malware by 2 feeds and 19 CRITICAL EtherHiding IDS alerts.

Risk Factors (5)

Multi-source threat-intel match on the primary domain reporting clearfake malware

19 CRITICAL IDS alerts for EtherHiding exfiltration (EP MALWARE EtherHiding Exfil M2)

Fake security-verification page instructing the visitor to paste and execute a command in PowerShell/Terminal (ClickFix technique)

Connections to BSC testnet RPC endpoints used for blockchain-hosted payload retrieval

Content hidden behind a cosmetic 404/maintenance wrapper while OCR shows a different, interactive verification page

Domain age information unavailable

Details

Page Title

404 – Kamata Ticket

Scan Type

public

Favicon Hash

MMH3: 82929661

MD5: bf94e07e0a779d79df228711543a696b

Domain Name Analysis

You're looking at domain 'kamataticket.com' on the commercial generic top-level domain (.com) without a subdomain. The second-level label 'kamataticket' is 12 characters long split between 5 vowels and seven consonants. It segments into two words: kamata, ticket. Average segment length settles at 6 characters. No strong language cues emerged from the frequency lists.

Screenshot

OEP Ticket ISITEIENTMODE[MAINTENANCE Nous effectuons actuellement des travaux de maintenance pour améliorer votre Notre site sera de retour tres bientét,-encore mieux qu‘avant | ‘Merci pour, votre...

Page Load Overview

5.68s

Total Load Time

691 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:58%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:fr-FR

Text Length:1,159 chars

Detector Agreement:100%

Language mismatch: Declared as fr-FR but detected as en

Website Classification

Primary Category

technology software78% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

78%

documentation technical

56%

government public service

32%

phishing scam

29%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
12	213.255.195.46	France	AS210403Groupe LWS SARL
5	142.251.13.95Google · CDN	United States	AS15169Google LLC
5	142.215.53.55	Washington, District of Columbia, United States	AS15830Equinix (EMEA) Acquisition Enterprises B.V.
5	3.33.155.121Aws · CLOUD	United States	AS16509Amazon.com, Inc.
5	52.223.48.152Aws · CLOUD	United States	AS16509Amazon.com, Inc.
5	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	172.66.150.162Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	3.33.196.84Aws · CLOUD	United States	AS16509Amazon.com, Inc.
5	15.197.198.189Aws · CLOUD	United States	AS16509Amazon.com, Inc.
5	142.251.20.94Google · CDN	United States	AS15169Google LLC
82	15	-	-