Security Scan: korowater.com

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a649e5ba-b4e1-4a44-a46b-7ca83e79a8c1 Domain and IP registration (RDAP)/api/v1/rdap/a649e5ba-b4e1-4a44-a46b-7ca83e79a8c1How often this domain was scanned/api/v1/domain/stats/korowater.com Scan history for this domain/api/v1/domain/history/korowater.com?limit=15

This website contacted 6 IPs in 3 countries across 5 domains to perform 18 HTTP transactions. The main domain is korowater.com and was registered 3 years ago.

Submitted URL: https://korowater.com

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Compromised WordPress host serving a ClickFix/ClearFake chain: fake Cloudflare robot check that copies a Windows shell command to the clipboard and loads an EtherHiding second stage. Do not interact; report immediately.

Risk Factors (7)

ClickFix fake-CAPTCHA malware delivery chain (clipboard shell injection via Win+X / Terminal instructions)

ClearFake/EtherHiding loader using blockchain RPC (polygon.drpc.org) to fetch a second-stage payload

Fake Cloudflare 'verify you are human' overlay impersonating Cloudflare trust UI

Critical network IDS alert 'ET MALWARE EtherHiding Exfil' (x4) and Spamhaus-listed traffic

Compromised site injecting ClickFix kits alongside unrelated casino/SEO spam content

DevTools and right-click blocked (anti-analysis)

Loaded third-party domain brows-check.codes reported malicious by two independent threat feeds

Domain age information unavailable

Details

Page Title

korowater.com

Scan Type

public

Favicon Hash

MMH3: 1198047028

MD5: 000bf649cc8f6bf27cfb04d1bcdcd3c7

Domain Name Analysis

The domain name 'korowater.com' uses the commercial generic top-level domain (.com) without a subdomain. The second-level label 'korowater' is 9 characters long containing 4 vowels alongside five consonants. Word splitting yields 2 words: koro, water. Median word length comes out to 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.53s

Total Load Time

678 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:2,345 chars

Detector Agreement:100%

Website Classification

Primary Category

gambling betting89% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

gambling betting

89%

cryptocurrency blockchain

74%

entertainment media

71%

finance banking

60%

technology software

58%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	103.153.73.98	Vietnam	AS135905VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
3	172.66.146.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
3	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	142.251.127.100Google · CDN	United States	AS15169Google LLC
3	142.251.13.132Google · CDN	United States	AS15169Google LLC
18	6	-	-