Security Report: userswordpress-signin-customer.aromadiroma.org - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a77226ed-f0d3-46a3-88de-17bcd6c33f60 Domain and IP registration (RDAP)/api/v1/rdap/a77226ed-f0d3-46a3-88de-17bcd6c33f60How often this domain was scanned/api/v1/domain/stats/userswordpress-signin-customer.aromadiroma.org Scan history for this domain/api/v1/domain/history/userswordpress-signin-customer.aromadiroma.org?limit=15

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main domain is aromadiroma.org and was registered 12 years ago.

Submitted URL: https://userswordpress-signin-customer.aromadiroma.org/

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Fake WordPress.com 'order validation' page on an unrelated domain collecting full card details — brand impersonation plus payment harvesting, corroborated by phishing threat-intel reports.

Risk Factors (6)

WordPress.com branding used on an unrelated third-party domain (aromadiroma.org)

Payment card form (card number, expiry, CVV) on a domain that is not the brand's own

Phishing threat-intel report on the primary domain

Third-party vercel-storage blob resource flagged as phishing

Subdomain name crafted to mimic a WordPress account/order flow ('userswordpress-signin-customer')

Generic card-skimming JavaScript pattern present

Domain age information unavailable

Details

Page Title

WordPress.com - Secure order validation

Scan Type

public

Domain Name Analysis

Domain 'userswordpress-signin-customer.aromadiroma.org' uses the non-profit oriented generic top-level domain (.org) and includes subdomain 'userswordpress-signin-customer'. The registrable portion 'aromadiroma' spans 11 characters with six vowels and 5 consonants. Word splitting yields three words: aroma, di, roma. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.59s

Total Load Time

102 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:797 chars

Detector Agreement:75%

Website Classification

Primary Category

e-commerce40% confidence

Type: static

Method: structural

All Detected Categories

e-commerce

40%

Detected Features

Payment

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	188.213.166.207	Arezzo, Tuscany, Italy	AS31034Aruba S.p.A.
3	3.64.223.116Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
6	2	-	-

Detected Technologies2

PHPv8.4.27

40%

Nginx

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15612986050F5447B919380C6AAA5AF6B3FE0E217CA5B010476FD9BA50FCBC83ED6316D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:nmQfawoDjRppOJWCFU+hzcu8YTaNRlOzNaIn:m5DjfABUKQRwNaa

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:9743:El3CQacwQCwDKHADFEUBEKhwAdAHCQWgRJAKnIYgUxOINAKA0iNwNGCKFYAhAtEgTMiAgFOC2CSSAINEYABQJBDkBiHKQqRR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7f9696fc96969eaf

Perceptual Hash:9f948995c1c3c397

Difference Hash:f0346c6032666250

Wavelet Hash:7f9e86bc8090b8a9

Color Hash:#741f93

Other Hashes

Crop Resistant:f0346c6032666250

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: userswordpress-signin-customer.aromadiroma.org