Security Scan Report: ukplus.co.kr

Site favicon
Submitted: Completed: publiccompleted
This website contacted 14 IPs in 4 countries across 15 domains to perform 100 HTTP transactions. The main domain is ukplus.co.kr and was registered 17 years ago.

Submitted URL: https://ukplus.co.kr

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Aged, otherwise-legitimate UK study-abroad site that appears compromised: HTML carries the analyst-vetted ErrTraffic/Exvicy WordPress injection loader, CRITICAL EtherHiding/ClickFix IDS alerts, and malware-flagged third-party scripts. Do not interact.

Risk Factors (5)
Analyst-vetted CRITICAL YARA/phishing kit (ErrTraffic/Exvicy) found in the page HTML
CRITICAL IDS malware alerts (EtherHiding exfiltration, ClickFix domain)
Blockchain RPC/smart-contract calls used as a payload channel
Page loads multiple malware-flagged third-party domains (lovezramexar.info, ohhhhhmoney.com, rehearsal-b.com)
Unranked third-party script host injecting content
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain 'ukplus.co.kr' uses the South Korean country-code top-level domain (.co.kr) with no subdomain. The second-level label 'ukplus' is 6 characters long split between two vowels and 4 consonants. Word splitting yields two words: uk, plus. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ukplus.co.kr

Page Load Overview

75.12s
Total Load Time
882 KB
Total Size

Language Analysis

Primary Language

🇰🇷Korean
Code: ko
Confidence:80%
Script:Hangul
Direction:ltr

Detection Details

HTML Lang Attribute:ko-KR
Text Length:1,481 chars
Detector Agreement:67%

Website Classification

Primary Category

education learning48% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

education learning
48%
travel tourism
36%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
9115.41.222.126South Korea
AS45996DAOU TECHNOLOGY
7142.251.127.95Google · CDNUnited States
AS15169Google LLC
7152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
7158.94.211.226Rotterdam, South Holland, Netherlands
AS202412Omegatech LTD
7104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7142.251.13.95Google · CDNUnited States
AS15169Google LLC
7142.251.14.94Google · CDNUnited States
AS15169Google LLC
7172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7172.67.171.128Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7104.26.4.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
10014--

Detected Technologies5

WordPressv6.2.14
100%
JQueryv3.6.4
100%
50%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1042376F108AEF07E265ABA49B068E329D7E35206CE065B5573FC224CCBD5F5948E311E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:SLpn0Q3ZdqZUaA9nzkWtAzu4QpsVf3OgZr1mxUWdFvm68tDXgeazcMtb6mYKGtDm:Yn0aZdapKaK4Rl3OgZr1reTDGtjON

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:46723:glwsYawGJIQ8JDISQAwGHq2CTQUAIQiAJlRGSWaA8AUCGIMoJCGwggCFsFwMCB1EQhIMAAIhwESpGIpRPUEIGUD0YjYQDDRi

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:beff9fcfefdf0000
Perceptual Hash:bdc54ec3631e1c0e
Difference Hash:201030181a38393d
Wavelet Hash:00ff9fcfef8f0000
Color Hash:#3a4378

Other Hashes

Crop Resistant:201030181a38393d

Scan History

Scan history not available

Unable to load historical scan data