Security Scan: https://checkgps.com/

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/b88089c7-3569-47a8-bd27-d037bfe83efa Domain and IP registration (RDAP)/api/v1/rdap/b88089c7-3569-47a8-bd27-d037bfe83efa Certificate Transparency/api/v1/ct/checkgps.com How often this domain was scanned/api/v1/domain/stats/checkgps.com Scan history for this domain/api/v1/domain/history/checkgps.com?limit=15

This website contacted 8 IPs in 3 countries across 7 domains to perform 11 HTTP transactions. The main domain is checkgps.com and was registered 21 years ago.

Submitted URL: https://checkgps.com/

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Compromised site serving a fake Cloudflare 'Human Verification' ClickFix lure that tells users to paste code into Windows Terminal, with an analyst-vetted ErrTraffic/Exvicy WordPress loader, EtherHiding exfil and multi-feed threat-intel hits. Do not interact.

Risk Factors (7)

Known malicious ClickFix/phishing kit (ErrTraffic/Exvicy) injected into the page

Fake 'Human Verification' CAPTCHA instructing clipboard paste into Windows Terminal (ClickFix social engineering)

CRITICAL IDS malware exfiltration alerts (ET MALWARE EtherHiding Exfil M2)

Multi-feed threat-intel match on the primary domain (ek clearfake-1)

Blockchain RPC connections consistent with EtherHiding C2/dead-drop infrastructure

Loads JavaScript from unranked script host browseid.codes

Impersonates Cloudflare's security-check branding on a non-Cloudflare domain

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Favicon Hash

MMH3: 299010594

MD5: a5eede6d4ed9583b0ef3475a52f26292

Domain Name Analysis

Domain 'checkgps.com' uses the commercial generic top-level domain (.com). Its registrable label 'checkgps' stretches across 8 characters containing 1 vowel alongside 7 consonants. Word splitting yields 2 words: check, gps. Expect four characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.15s

Total Load Time

74 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

Text Length:462 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software34% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

34%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	92.240.69.171	Riga, Riga, Latvia	AS5538Institute of Mathematics and Computer Science of University of Latvia
1	193.32.220.131	Frankfurt am Main, Hesse, Germany	AS48314IP-Projects GmbH & Co. KG
1	104.18.11.59Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
1	104.26.5.88Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
1	193.32.220.134	Frankfurt am Main, Hesse, Germany	AS48314IP-Projects GmbH & Co. KG
1	104.18.10.59Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
11	8	-	-