Security Scan Report: thorfish.is

Submitted: Completed: publiccompleted
This website contacted 8 IPs in 2 countries across 5 domains to perform 6 HTTP transactions. The main domain is thorfish.is and was registered 26 years ago.

Submitted URL: https://thorfish.is/captcha.html

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

ClickFix fake CAPTCHA impersonating Cloudflare that copies a Windows shell/PowerShell command to the clipboard and walks the victim through pasting and running it. hunting rule kit-roster hit and malware IDS alert confirm malicious intent.

Risk Factors (5)
Fake 'Verify you are human' CAPTCHA used as a malware-delivery lure
Copies a malicious command to the visitor's clipboard and directs them into PowerShell (Win+R / Win+X technique)
Impersonates Cloudflare's bot-protection challenge (styling, 'needs to review the security of your connection' wording, fake Ray ID) on a domain not belonging to Cloudflare
Threat-intel URL match reporting https://thorfish.is/captcha.html as malware_download (urlhaus.abuse.ch, single-source unverified)
Inline scripts use encoding/decoding functions and contact an external IP-lookup service, consistent with ClickFix victim telemetry
Domain age information unavailable

Details

Page Title

Just a moment...

Scan Type

public

Domain Name Analysis

The domain 'thorfish.is' uses the Icelandic country-code top-level domain (.is). The registrable portion 'thorfish' spans 8 characters containing 2 vowels alongside six consonants. Splitting it apart reveals two words: thor, fish. The median word length lands at four characters. No strong language cues emerged from the frequency lists.

Screenshot

@ thorfish.is Verify you are human by completing the action below. I'm not a robot eu thorfish.is needs to review the security of your connection before proceeding. Ray ID: O4ead64bf5854b82 + 2926...

Page Load Overview

0.51s
Total Load Time
16 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:772 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software48% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
48%
documentation technical
33%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6185.112.145.214Iceland
AS449251984 ehf
0172.67.74.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0142.251.155.119Google · CDNUnited States
AS15169Google LLC
0142.251.20.104Google · CDNUnited States
AS15169Google LLC
0142.251.152.119Google · CDNUnited States
AS15169Google LLC
0142.251.13.147Google · CDNUnited States
AS15169Google LLC
0142.251.151.119Google · CDNUnited States
AS15169Google LLC
0142.251.20.99Google · CDNUnited States
AS15169Google LLC
68--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15933073561F50032101E825DAA0BB76472224097EFC5EBE97BCD81609FCE85FA5B35BC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:w521ujnfGSnFT323aqWI80iSAfpfCfL4oWvs+s04FY5gnpDhzuz4zFzHj4j6T+T0:wXpT323FvhiNpsYvz5gntVUuBDWYU0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:53109:AyAQCGIClCTUAMOSBPkBohaaMgQBWiYhIAggRPWODWLZUMiOMGlABZDvNkghRRVGOBgiABEsFAZAoBRCBGxJKoOCJQnzB4wo

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:dfc3c3c3ffffffe7
Perceptual Hash:b03822cfc7cdc3c3
Difference Hash:309c1cb64000000c
Wavelet Hash:1f0303033f3f3f03
Color Hash:N/A

Other Hashes

Crop Resistant:309c1cb64000000c

Scan History

Scan history not available

Unable to load historical scan data