Security Scan: https://javascript.skin/channel/D.B.B1/weifil

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/aa21b9c4-8008-4fb8-80af-9a39eef2be11 Domain and IP registration (RDAP)/api/v1/rdap/aa21b9c4-8008-4fb8-80af-9a39eef2be11How often this domain was scanned/api/v1/domain/stats/javascript.skin Scan history for this domain/api/v1/domain/history/javascript.skin?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is javascript.skin and was registered 3 weeks ago.

Submitted URL: https://javascript.skin/channel/D.B.B1/weifile/index.js?_=1792409312505

AI Security Verdict

Confirmed Scam

Confidence: 94%

Risk Score

Served JavaScript is a DarkSword iOS exploit-kit loader (Coruna wallet stealer), confirmed by roster-anchored critical YARA hits on a 21-day-old domain. Do not load or execute.

Risk Factors (4)

Known malicious exploit kit identified by analyst-vetted kit roster (Coruna wallet stealer delivery)

Critical-severity YARA matches for DarkSword iOS exploit captcha gate (2 rules)

Very new domain (21 days) used to serve loader/routing JavaScript

Unranked domain with no reputation, consistent with disposable malware infrastructure

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Within the .skin top-level domain, 'javascript.skin' is registered without a subdomain. Count 10 characters in 'javascript' containing three vowels alongside 7 consonants. It segments into one word: javascript. Median word length is ten characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.75s

Total Load Time

23 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:29%

Script:Latin

Direction:ltr

Detection Details

Text Length:47,726 chars

Detector Agreement:100%

Website Classification

Primary Category

healthcare medical66% confidence

Type: static

Method: ml+structural

All Detected Categories

healthcare medical

66%

cryptocurrency blockchain

61%

news media journalism

61%

technology software

54%

finance banking

53%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	104.21.85.117Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	172.67.205.149Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	2	-	-

Detected Technologies3

HTTP/3

40%

Cloudflare Bot Management

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1B1238DEDA7C42ADC58B488D795331A6E23F0D70B2C18326E738BAE91B44F7209D90735

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:OMmzThFJqWx7EyYPWtBBYBS/8XuxzddhycF45cNR83V4VJAIBy3K1QG8lf1:gz9qQEyruiDyTcNaKWU8lf1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:48078:Tg2oNAQeSpTsGEhRxPAZQuKAABQTFcNQBRjiIIStHMAFCVAR5kGFDAEMVAMBIICCCSwDApOsUpw6EWgIRIwI3SGQgI5gM6bE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff00010181010101

Perceptual Hash:aab5a5adaba8a0a9

Difference Hash:5b21011141452109

Wavelet Hash:ff8081ff8101db8d

Color Hash:#40acbf

Other Hashes

Crop Resistant:5b21011141452109

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: javascript.skin