Security Scan Report: ty-le-keo.futbol

Site favicon
Submitted: Oct 8, 2026, 2:16:35 PMCompleted: Oct 8, 2026, 2:17:15 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Compromised WordPress site confirmed serving the ClearFake blockchain loader; its primary domain is flagged as clearfake malware by two feeds, with CRITICAL exploit-kit/CnC IDS alerts and a Safe Browsing warning. Avoid interaction.

Risk Factors (5)
ClearFake malicious kit (ClearFake_Polygon_Contract_Loader) injected in page HTML
Primary domain flagged as clearfake malware by 2 independent threat-intel feeds
Multiple CRITICAL IDS alerts for Gholoader/TA569 and TA2726 exploit-kit command-and-control
Google Safe Browsing: Unwanted Software
Compromised WordPress site serving multi-language gambling SEO spam; scripts contact unranked websocket hosts (bugsolve.net, speed-rankeer-east.com) and flagged rehearsal-b.com
Domain age information unavailable

Details

Page Title

Keo Nha Cai 5

Scan Type

public

Domain Name Analysis

The domain 'ty-le-keo.futbol' uses the .futbol top-level domain while skipping any subdomain. Its registrable label 'ty-le-keo' stretches across 9 characters with three vowels and four consonants; bonus characters include two hyphens. Breaking it apart gives three words: ty, le, keo. Expect 2 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ty-le-keo.futbol

Page Load Overview

4.72s
Total Load Time
242 KB
Total Size

Language Analysis

Primary Language

🇵🇱Polish
Code: pl
Confidence:17%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:vi
Text Length:6,542 chars
Detector Agreement:33%
Language mismatch: Declared as vi but detected as pl

Website Classification

Primary Category

gambling betting94% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

gambling betting
94%
finance banking
55%
forum
25%
news/blog
20%

Detected Features

Search
Articles
Comments

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4172.67.147.199Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.21.95.226Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.127.84Google · CDNUnited States
AS15169Google LLC
4188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.21.28.233Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4151.236.16.211Los Angeles, California, United States
AS9009M247 Europe SRL
307--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T162D32B225DF296A783B761AB8DA0E728705E72698F119D84B7FD00181FD1FDE853231A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:lytlXzn1+4I4OfIggfj6kn04MlkXBbkpYtuCFG0WSgfAppIj3E393AovF2xqUEfW:eL+4Ia8GL93Abb

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:137305:CLSIhUWhx4MCIVngYgICh0XlIBBCpEAEByJV7EBcywLrYjJQFVAMCBAQBgVYQ9gAARIWoLCIARBhEQqrQAwDVUaQzMEEACqK

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00f9c3fbebcbffff
Perceptual Hash:f94b16561616364f
Difference Hash:340b1b121a1a1a1c
Wavelet Hash:00c1c3ebc3c3ebc7
Color Hash:#c179d2

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data