Security Scan Report: bvraccounting.co.za

Site favicon
Submitted: Oct 8, 2026, 11:56:08 AMCompleted: Oct 8, 2026, 11:56:55 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Established accounting site that has been compromised: injected ClickFix/AMOS infostealer kits, fake Cloudflare verification overlay, blockchain-RPC exfiltration and casino SEO spam. Do not interact; the domain owner should be alerted to clean it.

Risk Factors (5)
Compromised legitimate accounting site serving ClickFix social-engineering/infostealer payloads to visitors
CRITICAL YARA hits for ClickFix loaders and fake 'Human Verification' overlay targeting Windows and macOS users
CRITICAL IDS alerts for AMOS ClickFix campaign and EtherHiding exfiltration over blockchain RPC domains
Unrelated casino/betting spam content injected into site pages (SEO poisoning on a hijacked domain)
Unranked third-party script host poalmcreorvelvet.pro contacted via sendBeacon
Domain age information unavailable

Details

Page Title

Botha and van Rooyen Accountants

Scan Type

public

Domain Name Analysis

The domain name 'bvraccounting.co.za' uses the South African country-code top-level domain (.co.za) and has no subdomain. The registrable portion 'bvraccounting' spans 13 characters holding four vowels versus nine consonants. Segmentation suggests 3 words: b, vr, accounting. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://bvraccounting.co.za

Page Load Overview

10.51s
Total Load Time
2.7 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:8,069 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking67% confidence
Type: spa
Method: ml+structural

All Detected Categories

finance banking
67%
documentation technical
34%
news/blog
20%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
12197.221.2.63Cape Town, Western Cape, South Africa
AS37153Xneelo (Pty) Ltd
5142.250.154.95Google · CDNUnited States
AS15169Google LLC
5193.29.224.97Helsinki, Uusimaa, Finland
AS210644Aeza Group LLC
5104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
5142.251.155.119Google · CDNUnited States
AS15169Google LLC
535.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
5178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
5142.251.14.94Google · CDNUnited States
AS15169Google LLC
5104.21.95.226Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8716--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1E114292177A0153A222F03EEE05BB70C50A6DAA3DA4D67F5F4FD806952E4FD23173629

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:Y+Pxk+As0YLYQYA8tSNvfqUfA6vJZ5VwE8KQJxYPxgT35lOkvMUi:l8s0YLYQYwWm

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:200028:CwPCKwgnlgDhSEoTmHjwhmGgkq6CKcMiCAwAIoGQeiqKZ8AAQgJsAIAioAgEgghIagIiADRQVAIGhFEYSqxAwJGVIDiUoAVD

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data