ScanMalware.com

Security Scan Report: escapeai.live

Redirected to:
https://escapeai.live/login
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f8a299b3-6e37-4871-bf9c-4f691e1e0c53Domain and IP registration (RDAP)/api/v1/rdap/f8a299b3-6e37-4871-bf9c-4f691e1e0c53How often this domain was scanned/api/v1/domain/stats/escapeai.liveScan history for this domain/api/v1/domain/history/escapeai.live?limit=15
This website contacted 4 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main domain is escapeai.live and was registered 8 months ago.

Submitted URL: https://escapeai.live

Effective URL:
https://escapeai.live/login
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Credential-harvesting login page on escapeai.live, a domain flagged by two independent feeds for Amos malware, presenting 'ICMacOs' branding inconsistent with its own domain. Confirmed scam.

Risk Factors (4)
Multi-source malware Indicator of Compromise (Amos) tied to the primary domain serving this page
Credential-harvesting login form (password field) on a domain inconsistent with the displayed brand
Domain unknown to Cisco Umbrella reputation ranking despite claiming to be a branded sign-in
No legitimate business footprint (legitimacy score 10/100)
Domain age information unavailable

Details

Page Title

ICMacOs — Login

Scan Type

public

Domain Name Analysis

Within the .live top-level domain, 'escapeai.live' is registered while skipping any subdomain. Its registrable label 'escapeai' stretches across 8 characters split between five vowels and 3 consonants. Word splitting yields three words: escape, a, i. Median word length comes out to one character. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://escapeai.live

Page Load Overview

4.96s
Total Load Time
178 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:73%
Script:Latin
Direction:ltr

Detection Details

Text Length:69 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software46% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software
46%
news media journalism
37%
documentation technical
35%
cryptocurrency blockchain
33%
government public service
31%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3104.17.207.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
185.137.253.61Falkenstein, Saxony, Germany
AS215428Mykyta Skorobohatko
123.209.125.175Akamai · CDNHaarlem, North Holland, Netherlands
AS20940Akamai International B.V.
1104.17.208.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
64--

Detected Technologies3

PasswordField
100%
HTTP/3
40%
HSTS
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17561822633A010AABA02C658358B6F4D7298E607C501CE7C78ED15A0CBDDBB749FB34C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:PB7FGO7SFCt4EQhxG7QriRGkRZsVSbmHprUJzXbje5:57FBOFCt4EQfOQrikkRZsVKmHpwJzrm

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:3351:MIIEACoAAAAgAAASwIISAATEKMAAAgQEAAAiAQIYAAQAQAAAABQGQKAgoIKABQQCgIAMCAg4gDACCQFQMAAAQAAAJIAABQQA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000181818180000
Perceptual Hash:cc3333cc66339966
Difference Hash:0008323232320c10
Wavelet Hash:00001c1c3c3c0c0c
Color Hash:#8153ac

Other Hashes

Crop Resistant:0008323232320c10

Scan History

Scan history not available

Unable to load historical scan data