Security Scan Report: watteejai.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 11 IPs in 3 countries across 8 domains to perform 150 HTTP transactions. The main domain is watteejai.com and was registered 1 year 6 months ago.

Submitted URL: https://watteejai.com

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Compromised Thai astrology site serving ClickFix malware: clipboard shell command, fake Cloudflare verification overlay, YARA-confirmed kit and critical EtherHiding IDS alerts. Do not paste anything.

Risk Factors (7)
Clipboard shell-command injection (ClickFix) delivering malware via fake human-verification overlay
Fake Cloudflare 'security verification' / Ray ID screen impersonating Cloudflare
Known malicious kit family clickfix-winx-overlay-2026-10 confirmed by YARA and kit roster
Critical IDS malware alerts (EtherHiding Exfil M2 x19)
Blockchain RPC fetch to a testnet node for payload staging
Primary domain tagged ClearFake in threat intelligence
Six cross-domain redirects before the final page
Domain age information unavailable

Details

Page Title

วัดที่ใจ | รวมเรื่องโหราศาสตร์ เครื่องราง ความเชื่อ และคำสอนพระแท้

Scan Type

public

Domain Name Analysis

The domain 'watteejai.com' uses the commercial generic top-level domain (.com) without a subdomain. The core label 'watteejai' covers 9 characters holding 5 vowels versus 4 consonants. It segments into three words: watt, ee, jai. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://watteejai.com

Page Load Overview

7.65s
Total Load Time
30.6 MB
Total Size

Language Analysis

Primary Language

🇹🇭Thai
Code: th
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:th
Text Length:5,181 chars
Detector Agreement:100%

Website Classification

Primary Category

adult content62% confidence
Type: spa
Method: ml+structural

All Detected Categories

adult content
62%
corporate
25%
news/blog
20%

Detected Features

Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
20103.27.200.67Thailand
AS58955Bangmod Enterprise Co., Ltd.
13142.251.14.95Google · CDNUnited States
AS15169Google LLC
13172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1315.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
1334.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
13104.21.27.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1387.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
1387.250.251.119Yandex · CLOUDRussia
AS13238YANDEX LLC
1377.88.21.119Yandex · CLOUDMoscow, Moscow, Russia
AS13238YANDEX LLC
15011--

Detected Technologies12

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19044E7723959287A31AF02CFA002330C619BEFF6E6A1E9E5F4FF601497F0E853592595

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:UYS3cOZoWjY5fAXPY5fAXmvINCRzHWN328ZEgGoXNKeqR7P8hTzsUDT:MZoWjY5fAXPY5fAXmvIMVy

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:275567:UCEABYJAEhAhIFzJSgKTSECEkCSBmxgcuKWCYiAYKozKgABIgIGGgmUAccIgBgMJKicaookA4KAjQAgACSSk6kCa2JUEJJXA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:dec3c3ffffffffe7
Perceptual Hash:b03830cdc7c7c7c6
Difference Hash:129e16100000100c
Wavelet Hash:c2c2cfdff0f0e0c0
Color Hash:#862d67

Other Hashes

Crop Resistant:129e16100000100c

Scan History

Scan history not available

Unable to load historical scan data