ScanMalware.com

Security Scan Report: unodeagosto.com

Submitted: Oct 11, 2026, 10:20:17 PMCompleted: Oct 11, 2026, 10:20:55 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Compromised WordPress coffee-shop site serving the ClearFake EtherHiding loader (blockchain RPC from inline script), with CRITICAL IDS malware alerts, malware Indicators of Compromise on the domain and a loaded resource, and injected casino SEO spam. Do not visit.

Risk Factors (6)
Known malicious kit (ClearFake / EtherHiding blockchain contract loader) detected in page HTML by analyst-vetted YARA rule
CRITICAL IDS alert for EtherHiding malware exfiltration
Page connects to a public Polygon RPC endpoint and posts to it cross-origin from inline script
Malware Indicators of Compromise on the primary domain (unknown loader) and on a third-party resource it loads (iclickfix, 2 feeds)
Injected hidden gambling/SEO spam links in the footer indicating a compromised CMS (WordPress theme)
No forms or credential collection present — the threat is script-based malware loading, not phishing forms
Domain age information unavailable

Details

Page Title

unodeagosto

Scan Type

public

Domain Name Analysis

The domain 'unodeagosto.com' uses the commercial generic top-level domain (.com). Its registrable label 'unodeagosto' stretches across 11 characters containing six vowels alongside 5 consonants. Word splitting yields three words: u, node, agosto. The median word length lands at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://unodeagosto.com

Page Load Overview

3.47s
Total Load Time
3.6 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:44%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:es
Text Length:2,525 chars
Detector Agreement:100%
Language mismatch: Declared as es but detected as en

Website Classification

Primary Category

government public service38% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

government public service
38%
blog personal website
36%
education learning
33%
healthcare medical
32%
adult content
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8217.160.0.60Germany
AS8560IONOS SE
7172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7104.21.52.144Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7104.21.2.178Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
294--

Detected Technologies7

WordPressv6.8.3
100%
MetaGenerator
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%
WordPress Site Editor
30%
WordPress Block Editor
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1B2A33A61536448FA797F4BA9EC29F718B254ED01CE45A6D6F4E2E00498CCEF605B3B0E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:S5ZNVAw9l7GdGUuJpZKuzemlUYug6LU18rp:pw9ZGdpuvZKuzemlUYug6LUe

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:107061:zOBYYCC7WBjSqGkEAHCBliNMB0MESEAPPjRCsioAREA5MoMAgUoUk0YAXKKMDiIoaiRwBGEASZnBoYRAMvEgpFCbAADAEiRH

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff9f8c98988000ff
Perceptual Hash:de94a17d8167f106
Difference Hash:683039332333616d
Wavelet Hash:ff9d9c98988000ff
Color Hash:#4dbf40

Other Hashes

Crop Resistant:683039332333616d,f03223b332262694,303839332a3b2165

Scan History

Scan history not available

Unable to load historical scan data