Security Scan Report: ufath1.com

Submitted: Completed: publiccompleted
This website contacted 5 IPs in 2 countries across 6 domains to perform 15 HTTP transactions. The main domain is ufath1.com and was registered 5 years ago.

Submitted URL: https://ufath1.com

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Compromised site serving a ClearFake blockchain-contract (EtherHiding) malware loader, confirmed by kit roster, deobfuscated script analysis and a CRITICAL IDS trojan alert. Visitors risk infection; avoid.

Risk Factors (5)
ClearFake Ethereum/Polygon blockchain loader detected on page (analyst-vetted malicious kit)
EtherHiding: next-stage payload address retrieved from a smart contract via public RPC nodes
Obfuscated script concealing traffic to threat-feed-flagged hosts (1rpc.io, polygon.drpc.org, polygon.publicnode.com)
CRITICAL network IDS alert for multi-stage JavaScript redirect (trojan activity)
Primary domain flagged as a malware loader; loaded third-party domain flagged as ClearFake distribution
Domain age information unavailable

Details

Page Title

UFABET เว็บแม่ เว็บพนันที่ดีที่สุดไม่ผ่านเอเย่นต์ -

Scan Type

public

Domain Name Analysis

Domain 'ufath1.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. The second-level label 'ufath1' is 6 characters long holding 2 vowels versus three consonants; it also includes one digit. Breaking it apart gives three words: ufa, th, 1. Median word length is two characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ufath1.com

Page Load Overview

1.16s
Total Load Time
349 KB
Total Size

Language Analysis

Primary Language

🇹🇭Thai
Code: th
Confidence:80%
Script:Unknown
Direction:ltr

Detection Details

HTML Lang Attribute:th
Text Length:348,617 chars
Detector Agreement:67%

Website Classification

Primary Category

entertainment media50% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

entertainment media
50%
gambling betting
37%
corporate
25%
news/blog
20%

Detected Features

Search
Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3178.33.169.66Stuttgart, Baden-Wurttemberg, Germany
AS16276OVH SAS
3142.251.14.95Google · CDNUnited States
AS15169Google LLC
3142.251.20.97Google · CDNUnited States
AS15169Google LLC
3142.250.154.94Google · CDNUnited States
AS15169Google LLC
3216.239.34.36Google · CDNUnited States
AS15169Google LLC
155--

Detected Technologies12

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19CA42C1753881373174243653F1E31E1AB2E8439632492A5B86E922C7393D6E96B7FFC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:1/1BQ8kKC0vC8fMG0GaGoGOGEG+GIGE8wMsiyezVcz8wMsiyezVcp/a:1DyKC2vNJUi

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:491872:osu7Bgg6M9k4UkC0AgBDAAQaljaQSEAEmtqA5wTCyCAMHRQzIoMeACD2PMCAJAGMANeQkIAcC0rXVwEQdASwMCyCaQQABoiM

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:1fc3c3e7c7c7e7e7
Perceptual Hash:b30c8e199ece3336
Difference Hash:30060e0c0c1c0c0c
Wavelet Hash:0ec2c2c2c7c7e6e6
Color Hash:#721f93

Other Hashes

Crop Resistant:30060e0c0c1c0c0c

Scan History

Scan history not available

Unable to load historical scan data