Security Scan Report: dondaddy.com.au

Submitted: Oct 8, 2026, 11:58:06 AMCompleted: Oct 8, 2026, 11:58:53 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

One-day-old site is compromised and serving the Macfinger ClickFix / AMOS macOS stealer, confirmed by a CRITICAL YARA rule, a CRITICAL IDS malware alert and analyst-vetted kit fingerprints. Do not visit or interact.

Risk Factors (5)
Known malicious ClickFix / AMOS stealer kit (Macfinger) confirmed by analyst roster and YARA
CRITICAL network IDS malware alert for AMOS loader script request
External unranked script host poalmcreorvelvet.pro receiving data via sendBeacon
Injected SEO-spam content unrelated to the site's stated food business (casino, music, geopolitical articles)
Very newly registered domain (1 day old) hosting unrelated multi-language spam
Domain age information unavailable

Details

Page Title

Don Daddy – Herbal Touched String Hoppers

Scan Type

public

Domain Name Analysis

The domain name 'dondaddy.com.au' uses the Australian country-code top-level domain (.com.au) with no subdomain. Count 8 characters in 'dondaddy' with 2 vowels and six consonants. Breaking it apart gives 2 words: don, daddy. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://dondaddy.com.au

Page Load Overview

3.81s
Total Load Time
846 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:103,604 chars
Detector Agreement:50%

Website Classification

Primary Category

e-commerce shopping60% confidence
Type: spa
Method: ml+structural

All Detected Categories

e-commerce shopping
60%
finance banking
53%
entertainment media
51%
documentation technical
36%
blog personal website
28%

Detected Features

Login Form
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1292.113.16.127Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
7142.251.13.95Google · CDNUnited States
AS15169Google LLC
7193.29.224.97Helsinki, Uusimaa, Finland
AS210644Aeza Group LLC
7192.0.73.2San Francisco, California, United States
AS2635Automattic, Inc
7142.251.14.94Google · CDNUnited States
AS15169Google LLC
792.113.16.145Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
792.113.23.236Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
7142.251.13.94Google · CDNUnited States
AS15169Google LLC
618--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T182444AE2C8DC053B03071BC6A154FB29B79B853DCB2958A3F2FFC2689781E62457E159

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:zSQK8wywGv+raocUsXrrWL6KsrCrQPer2lLsrmnUTrCNxWreTzibarmxsrCVUrOt:MGuoQTQz7f9C

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:253757:CBthSlgQzABigTmDsFIooQgAGQRItBEyAESwAUW6xAwnBYLkcIwBHfpCIfGhgdKoIYigCWEQ4RQmwpSxIIoQRQRjDGqlUEoR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff0000c3ffffffff
Perceptual Hash:e91cf396f7184318
Difference Hash:3c27102b2a2b2b0b
Wavelet Hash:04000001ffffffe7
Color Hash:#8c40bf

Scan History

Scan history not available

Unable to load historical scan data