Security Report: bill4ld8.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/91771c59-3375-4eca-87ba-df8e2b10afdd Domain and IP registration (RDAP)/api/v1/rdap/91771c59-3375-4eca-87ba-df8e2b10afdd Certificate Transparency/api/v1/ct/bill4ld8.com How often this domain was scanned/api/v1/domain/stats/bill4ld8.com Scan history for this domain/api/v1/domain/history/bill4ld8.com?limit=15

This website contacted 10 IPs in 2 countries across 9 domains to perform 105 HTTP transactions. The main domain is bill4ld8.com and was registered 17 years ago.

Submitted URL: https://bill4ld8.com/

AI Security Verdict

Confirmed Scam

Confidence: 90%

Risk Score

Legitimate-looking Arizona Senate campaign page that is compromised/serving the analyst-vetted DarkSword iOS exploit kit (Coruna wallet stealer), with 3 critical IDS exploit-kit alerts and multiple malware-threat-intel IoC resources. Avoid; report.

Risk Factors (5)

Analyst-vetted known malicious kit (DarkSword iOS exploit kit / Coruna wallet stealer) matched on the page

Critical network IDS exploit-kit alerts (landing page, RCE loader, RCE module)

Third-party malware IoC domains (apiforxwork.com/.net, translatevv.com, js.* variants) loaded by the page

Traffic to suspicious .icu domains (HTTP POST, DNS query, TLS SNI) and use of an IP-check service

Stolen victim IP-check + exploit delivery pattern typical of a compromised site serving a stealer chain

Domain age information unavailable

Details

Page Title

Bill Loughrige – Bill4ld8.com – A TRUSTED VOICE for all Arizonans.

Scan Type

public

Favicon Hash

MMH3: -1083534945

MD5: 9d183e6ebd3a26580826fb832be6cde4

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'bill4ld8.com' is registered and has no subdomain. The core label 'bill4ld8' covers 8 characters with one vowel and five consonants; it also includes two digits. Word splitting yields 4 words: bill, 4, ld, 8. Average segment length settles at 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

13.77s

Total Load Time

4.1 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:1,126 chars

Detector Agreement:100%

Website Classification

Primary Category

government public service61% confidence

Type: spa

Method: ml+structural

All Detected Categories

government public service

61%

education learning

52%

corporate business

39%

adult content

29%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
15	208.122.201.139	United States	AS27589MOJOHOST
10	142.251.110.95Google · CDN	United States	AS15169Google LLC
10	172.67.187.123Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
10	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	104.21.32.211Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	104.16.185.241Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	157.240.0.35Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
10	104.16.184.241Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
105	10	-	-