Security Scan Report: fonts-dns.pro

Site favicon
Submitted: Completed: publiccompleted
This website contacted 13 IPs in 2 countries across 7 domains to perform 15 HTTP transactions. The main domain is fonts-dns.pro and was registered 4 days ago.

Submitted URL: https://fonts-dns.pro/

AI Security Verdict

Confirmed Scam

Confidence: 98%

10
Risk Score

ClickFix malware page impersonating a Cloudflare human-verification check on a 3-day-old domain; it copies a Windows shell command to the clipboard and tells victims to run it via Win+R. Confirmed malicious.

Risk Factors (5)
Clipboard shell injection (pastejacking) with %COMSPEC% /c command staged for execution
Brand impersonation of Cloudflare on an unrelated newly registered domain
Social-engineering instructions guiding the victim to execute the pasted payload
Domain registered 3 days ago and absent from all reputation rankings
Title-domain mismatch ('Verification' page on fonts-dns.pro)
Domain age information unavailable

Details

Page Title

Cloudflare: Build for the agent eraother network

Scan Type

public

Domain Name Analysis

Domain 'fonts-dns.pro' uses the .pro top-level domain. The core label 'fonts-dns' covers 9 characters holding 1 vowel versus seven consonants; bonus characters include one hyphen. Segmentation suggests two words: fonts, dns. Average segment length settles at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://fonts-dns.pro/

Page Load Overview

0.21s
Total Load Time
842 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:532 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software68% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
68%
documentation technical
51%
adult content
43%
government public service
42%
blog personal website
40%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3103.101.85.188United Kingdom
AS199479Amtp LLC
1104.16.123.96Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.16.124.96Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.16.80.73Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.20.97Google · CDNUnited States
AS15169Google LLC
1104.18.87.42Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1151.101.1.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.18.35.200Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1192.178.183.95Google · CDNUnited States
AS15169Google LLC
1513--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T158051231170F796D66B888E1B12A6E087CE9A5BFB182C085FEC49354F0EEAD0DF49564

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:TYmCFqX+UQWErzbL7FtbnwEGS8DZNH5w2F3wW5/LchR70NJ3wk5oGu8sz:0mHXfQWE7L77Z1N2F3wx6JToGu8sz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:825865:gEAQoho0IAEQScQOVIC0ACAoRRUCExMCDFpQngq/Oio4DLDoQMEmCl4AgHosB0hgIgBHAWAA5oChKFQ1zEgiMLKIX6gA7AFA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fecec6ce82deffe7
Perceptual Hash:b131c6cccfc72638
Difference Hash:001c1c183626000c
Wavelet Hash:fe8e868e809efcc0
Color Hash:07000030000

Other Hashes

Crop Resistant:001c1c183626000c

Scan History

Scan history not available

Unable to load historical scan data