Security Scan: qqtime

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f9ac7cba-9012-40b9-af36-0b786a3d31a1 Domain and IP registration (RDAP)/api/v1/rdap/f9ac7cba-9012-40b9-af36-0b786a3d31a1How often this domain was scanned/api/v1/domain/stats/mobilecare.me Scan history for this domain/api/v1/domain/history/mobilecare.me?limit=15

This website contacted 4 IPs in 1 country across 3 domains to perform 13 HTTP transactions. The main domain is mobilecare.me and was registered 2 months ago.

Submitted URL: https://mobilecare.me/qqtime/qqtime.html

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Analyst-vetted DarkSword iOS exploit kit (Coruna wallet stealer) confirmed by CRITICAL hunting-rule hits, roster match and a malware threat-intel hit on the domain. Avoid entirely.

Risk Factors (6)

Analyst-vetted malicious kit detected (DarkSword iOS exploit chain delivering Coruna wallet stealer)

CRITICAL hunting rule DarkSword_iOS_Exploit_Captcha_Gate matched on page body

HIGH hunting rule Coruna_XOR_String_Decoding matched (exploit-kit string obfuscation)

Threat-intel content-malware match on the primary domain (apt unc6691-1, malware)

IP-fingerprinting request to ipv4.icanhazip.com with 5 HIGH Suricata alerts

Very new (29-day-old) unranked domain with no relation between title and domain

Domain age information unavailable

Details

Page Title

qqtime

Scan Type

public

Domain Name Analysis

Domain 'mobilecare.me' uses the Montenegrin country-code top-level domain (.me) while skipping any subdomain. The second-level label 'mobilecare' is 10 characters long holding five vowels versus 5 consonants. Splitting it apart reveals two words: mobile, care. Median word length comes out to 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.67s

Total Load Time

25 KB

Total Size

Language Analysis

Primary Language

🏳️UNKNOWN

Code: unknown

Confidence:0%

Detection Details

Text Length:6 chars

Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	172.67.191.238Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.16.184.241Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.21.89.239Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.16.185.241Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
13	4	-	-

Detected Technologies3

Cloudflare Bot Management

55%

HTTP/3

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D6D0226BFC02C234842022D048A2BA8881EC990082A1CCC062C2C4DFAC44FAACC270D0

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6:qzxHqtlArzsnMRmHEdxkGXnAqJmW/FyEjsVKKqz:kxHqbbMcH4xk3qJmWw/VKj

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:1:0:3e1ceb8b13cd2db3abb2047a8d556a5d

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:N/A

Perceptual Hash:N/A

Difference Hash:N/A

Wavelet Hash:N/A

Color Hash:N/A

Other Hashes

Crop Resistant:N/A

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: mobilecare.me