Security Scan Report: thorfish.is

Submitted: Completed: publiccompleted
This website contacted 9 IPs in 2 countries across 5 domains to perform 6 HTTP transactions. The main domain is thorfish.is and was registered 26 years ago.

Submitted URL: https://thorfish.is/captcha.html

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

ClickFix fake-CAPTCHA page impersonating a Cloudflare check that copies a PowerShell (iex) command to the clipboard for the victim to run; vetted kit match, critical IDS malware alert and URLhaus malware_download report confirm malware delivery.

Risk Factors (6)
Clipboard injection of a Windows shell command (iex / Invoke-Expression) for manual execution by the victim
Impersonation of a Cloudflare 'Just a moment...' / Turnstile human-verification wall, including fabricated 'Cloudflare Verification ID' and 'Ray ID' text
Known malicious kit identification from the vetted kit roster (clickfix-fakecaptcha)
Critical IDS malware alert for a ClickFix landing page
URLhaus malware_download report on the exact scanned URL
Domain unranked in Cisco Umbrella with no published registration date
Domain age information unavailable

Details

Page Title

Just a moment...

Scan Type

public

Domain Name Analysis

Domain 'thorfish.is' uses the Icelandic country-code top-level domain (.is) with no subdomain. The registrable portion 'thorfish' spans 8 characters containing two vowels alongside 6 consonants. Splitting it apart reveals 2 words: thor, fish. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://thorfish.is/captcha.html

Page Load Overview

4.96s
Total Load Time
16 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:772 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software47% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
47%
documentation technical
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6185.112.145.214Iceland
AS449251984 ehf
0172.67.74.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0142.251.150.119Google · CDNUnited States
AS15169Google LLC
0142.251.14.103Google · CDNUnited States
AS15169Google LLC
0104.26.12.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0142.251.153.119Google · CDNUnited States
AS15169Google LLC
0142.251.20.106Google · CDNUnited States
AS15169Google LLC
0142.251.152.119Google · CDNUnited States
AS15169Google LLC
0142.251.14.147Google · CDNUnited States
AS15169Google LLC
69--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D233073561F50032101E825DAA0BB76472224097EFC5EBE97BDD81609FCE85FA5B35BC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:w521ujnfGSnFT3G3lqWI80iSAfpfCfL4oWvs+s04FY5gnpDhzuz4zFzHj4j6T+T0:wXpT3G3MvhiNpsYvz5gntVUuBDWYU0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:53108:Cc4QBxAnQwHqQqcbQ1GGIAMMqA5UVQooGigwwAVgEAA0MFQBBoggAAUJ4wElygaIUFKCAVJENEEcoAYoTrIB1IBbZxSADEEW

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:dfc3c3c3ffffffe7
Perceptual Hash:b03822cfc7cdc3c3
Difference Hash:309c1cb64000000c
Wavelet Hash:fcc0c0c0fcfcfcc0
Color Hash:#4840bf

Other Hashes

Crop Resistant:309c1cb64000000c

Scan History

Scan history not available

Unable to load historical scan data