Security Scan Report: cerise-tic.golive.africa

Submitted: Completed: publiccompleted
This website contacted 11 IPs in 4 countries across 9 domains to perform 172 HTTP transactions. The main domain is golive.africa and was registered 4 years 4 months ago.

Submitted URL: https://cerise-tic.golive.africa

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Compromised legitimate IT-services site serving a ClearFake EtherHiding loader; multi-feed Indicators of Compromise and injected gambling spam. Do not visit or interact.

Risk Factors (6)
Known malicious ClearFake/EtherHiding loader injected into the page
CRITICAL high-precision YARA malware match with kit-roster anchor
Multi-feed content-malware Indicators of Compromise on the primary domain
Obfuscated script concealing threat-feed hosts and blockchain-based payload retrieval
Injected gambling spam content unrelated to the site's genuine business
Bot-protection challenge shown to scanners while residential clients receive different content
Domain age information unavailable

Details

Page Title

CERISE TIC

Scan Type

public

Domain Name Analysis

You're looking at domain 'cerise-tic.golive.africa' on the .africa top-level domain; it also runs on subdomain 'cerise-tic'. The core label 'golive' covers 6 characters holding 3 vowels versus 3 consonants. Tokenizing the label suggests 2 words: go, live. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://cerise-tic.golive.africa

Page Load Overview

9.86s
Total Load Time
12.4 MB
Total Size

Language Analysis

Primary Language

🇫🇷French
Code: fr
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:fr-FR
Text Length:15,261 chars
Detector Agreement:50%

Website Classification

Primary Category

gambling betting81% confidence
Type: spa
Method: ml+structural

All Detected Categories

gambling betting
81%
technology software
67%
entertainment media
52%
government public service
45%
documentation technical
44%

Detected Features

Articles
Comments

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
22185.50.188.134Lausanne, Vaud, Switzerland
AS198385AlpineDC SA
1574.125.29.95Google · CDNUnited States
AS15169Google LLC
15104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
15146.75.122.208Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
15185.92.183.208Riga, Riga, Latvia
AS56971Cgi Global Limited
15142.251.110.94Google · CDNUnited States
AS15169Google LLC
15157.240.0.35Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
15142.251.127.84Google · CDNUnited States
AS15169Google LLC
152.23.246.146Akamai · CDNFrankfurt am Main, Hesse, Germany
AS16625Akamai Technologies, Inc.
15104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
17211--

Detected Technologies9

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1957419907EA3193A322F039FD10BA60C20599AE7D69D67C2F0BD8125A7F5FD132E161D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:MfC6qXd/Flb8STMR/hNKTwkj7zq+GWq6kRF71Ui:MYkRN

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:365456:FhgoBmZh5mAmSoik6zgggQIAgUBcKEEkATAEACwAEVgcooAJZgENHAgQB4NqKCEKSETEAwKIET1yIArMwQyBTZgQCdMxWAIR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fefeffffffffffff
Perceptual Hash:d55555555554aaaa
Difference Hash:0000000000000000
Wavelet Hash:0000000002020202
Color Hash:#2d8667

Other Hashes

Crop Resistant:0000000000000000

Scan History

Scan history not available

Unable to load historical scan data