Security Scan Report: ukaramentalhealth.org

Site favicon
Submitted: Oct 8, 2026, 12:19:48 PMCompleted: Oct 8, 2026, 12:20:22 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 96%

9
Risk Score

Legitimate mental-health site appears compromised: injected ClickFix fake-CAPTCHA / AMOS macOS stealer kit, CRITICAL YARA hits and IDS malware alerts. Do not click anything or run copied commands.

Risk Factors (5)
Compromised legitimate site (ukaramentalhealth.org) injecting ClickFix fake-CAPTCHA stealer payloads
macOS AMOS stealer first-stage loader injected into page HTML
EtherHiding exfiltration via blockchain RPC (polygon-bor-rpc.publicnode.com) contacted by page scripts
Unranked attacker-controlled script hosts serving JS to this page
Threat-intel malware match on a loaded resource domain
Domain age information unavailable

Details

Page Title

Ukara Mental Health – Ukara Mental Health

Scan Type

public

Domain Name Analysis

The domain 'ukaramentalhealth.org' uses the non-profit oriented generic top-level domain (.org) and has no subdomain. The registrable portion 'ukaramentalhealth' spans 17 characters with seven vowels and 10 consonants. Breaking it apart gives 4 words: u, kara, mental, health. Median word length comes out to five characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ukaramentalhealth.org

Page Load Overview

2.29s
Total Load Time
329 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:111 chars
Detector Agreement:50%

Website Classification

Primary Category

adult content37% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

adult content
37%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8198.251.89.82Luxembourg, Luxembourg, Luxembourg
AS53667FranTech Solutions
1142.251.13.95Google · CDNUnited States
AS15169Google LLC
1193.29.224.97Helsinki, Uusimaa, Finland
AS210644Aeza Group LLC
1104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.110.94Google · CDNUnited States
AS15169Google LLC
1104.21.2.178Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.21.52.144Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
158--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17AB2D973F2B400667B5FC7EE8191B228E548A614DB46EB75B1F870688998EF700B371D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:Ub2WdNJ6Ih7Nr/ZdSZUaAhDkWjA7pd6dfx/nViZ2T8DZJ+ME0vWCJB0:bWzZdypaRjCmd6dJ+b0vLB0

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:25577:8qNKjBYgJIyCJpQEbgjMAOGVNYIICAmLkiQAdAHFTuCQUAPQIRZSeNiBhIhUFQhQdxgwABA0EMRXpDgHQMgYBX8oKdIwgCEA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:cfcf8fcfffffffff
Perceptual Hash:b838c7c7c73830c7
Difference Hash:1094301000100000
Wavelet Hash:d0c0808080f0f0f0
Color Hash:#77862d

Other Hashes

Crop Resistant:1094301000100000

Scan History

Scan history not available

Unable to load historical scan data