Security Scan Report: bj66bet.com

Site favicon
Submitted: Oct 14, 2026, 8:50:00 PMCompleted: Oct 14, 2026, 8:51:04 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Compromised gambling site serving an injected ClickFix kit: fake Cloudflare 'I'm not a robot' overlay, EtherHiding blockchain loader and CRITICAL YARA/IDS malware hits. Never complete the fake verification.

Risk Factors (6)
Injected ClickFix kit drawing a fake Cloudflare 'Human Verification' overlay that instructs Windows users to open Terminal (Win+X) and paste attacker PowerShell commands
EtherHiding loader: script fetches the overlay host from a Polygon smart contract, with multiple threat-feed blockchain RPC hosts hidden in obfuscated code
CRITICAL IDS malware/exploit-kit alerts (EtherHiding exfil, ErrTraffic Beer Cluster check-in) and Spamhaus-listed inbound traffic
Primary domain flagged as content-malware by two independent threat-intel feeds
Obfuscated JavaScript with Function() constructor code generation and cross-origin fetches to unranked hosts (chordapple.com, browse-codes-enter.beer)
Page impersonates a Cloudflare security check it does not own
Domain age information unavailable

Details

Page Title

BJ66 Da ga Truc Tiep - Trải Nghiệm Đá Gà Cực Chất Xem Là Mê

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'bj66bet.com' is registered and has no subdomain. Count 7 characters in 'bj66bet' containing one vowel alongside 4 consonants; it also includes two digits. Splitting it apart reveals 3 words: bj, 66, bet. Median word length comes out to 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://bj66bet.com

Page Load Overview

28.65s
Total Load Time
1.7 MB
Total Size

Language Analysis

Primary Language

🇻🇳Vietnamese
Code: vi
Confidence:62%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:15,203 chars
Detector Agreement:80%
Language mismatch: Declared as en-US but detected as vi

Website Classification

Primary Category

entertainment media99% confidence
Type: spa
Method: ml+structural

All Detected Categories

entertainment media
99%
gambling betting
93%
adult content
77%
blog personal website
68%
government public service
63%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2554.169.87.143Aws · CLOUDSingapore, Singapore
AS16509Amazon.com, Inc.
21132.145.155.63Oracle · CLOUDAshburn, Virginia, United States
AS31898Oracle Corporation
21178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
21172.67.180.48Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
21104.21.43.137Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1095--

Detected Technologies9

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T10A04D72272B42939321F12DFC01B320C60DBEFEAD694A7E5B5F66034AA74D9535F3219

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:TMUidh+TGNQyM4hMYa54MeqGwGDuvmEDh5Yd2C4xzJf:QldZNQyM4RO0E

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:182125:wekptAEHxBKIkDKACsAQyUPQkECUiAAoDFhnCiAjheVGAQAExhBAVDQRiOjMBHBADcDhYQRasCBDGygDHqglECVlQDAgIeIB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Scan History

Scan history not available

Unable to load historical scan data