Security Scan: Onishaspells

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/dad39668-2237-46d1-b9e6-9fc9cb8aaf14 Domain and IP registration (RDAP)/api/v1/rdap/dad39668-2237-46d1-b9e6-9fc9cb8aaf14 Certificate Transparency/api/v1/ct/onihaspells.com How often this domain was scanned/api/v1/domain/stats/onihaspells.com Scan history for this domain/api/v1/domain/history/onihaspells.com?limit=15

This website contacted 29 IPs in 2 countries across 13 domains to perform 65 HTTP transactions. The main domain is onihaspells.com and was registered 29 years ago.

Submitted URL: https://onihaspells.com

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Compromised spell-services site injected with the Windows ClickFix kit: an analyst-vetted fake Cloudflare 'Human Verification' overlay that instructs visitors to paste PowerShell into Terminal, loaded via EtherHiding from a Polygon contract. Do not follow the instructions.

Risk Factors (6)

Fake Cloudflare 'I'm not a robot' / Ray ID verification overlay used as a lure

Instructions to run PowerShell/terminal commands on the victim's machine (Win+X → Terminal → Ctrl+V → Enter)

Decoded obfuscated script contacts threat-feed hosts 1rpc.io, polygon.drpc.org and polygon.gateway.tenderly.co

Injected gambling/SEO spam text (пинко казино, casino bonus strings) unrelated to the site's content, indicating a compromised site

Unranked third-party script hosts browse-codes-enter.beer and wuntred.com serving JavaScript to the page

Threat-intel reports 'unknown loader (malware)' on the primary domain and 'ek clearfake' on a loaded resource address

Domain age information unavailable

Details

Page Title

Onishaspells

Scan Type

public

Favicon Hash

MMH3: 530492348

MD5: dcab89b8e04bf53fcd7f6a44a8cb4fae

Domain Name Analysis

The domain name 'onihaspells.com' uses the commercial generic top-level domain (.com) without a subdomain. The registrable portion 'onihaspells' spans 11 characters with four vowels and 7 consonants. Segmentation suggests 3 words: on, iha, spells. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.32s

Total Load Time

1.6 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:4,080 chars

Detector Agreement:67%

Website Classification

Primary Category

news/blog40% confidence

Type: dynamic

Method: structural

All Detected Categories

news/blog

40%

Detected Features

Articles

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
9	192.185.57.139	Ashburn, Virginia, United States	AS31898Oracle Corporation
2	142.251.14.95Google · CDN	United States	AS15169Google LLC
2	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	152.236.9.75	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
2	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
2	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
2	104.21.42.198Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.250.154.94Google · CDN	United States	AS15169Google LLC
2	142.251.127.102Google · CDN	United States	AS15169Google LLC
2	142.251.150.119Google · CDN	United States	AS15169Google LLC
65	29	-	-