Security Scan Report: wehavefeelingstoo.com

Site favicon
Submitted: Oct 14, 2026, 6:47:21 PMCompleted: Oct 14, 2026, 6:48:15 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

Legitimate-looking author/book page compromised with an injected ClickFix Win+X Terminal overlay impersonating Cloudflare, plus an EtherHiding blockchain loader — critical YARA, kit-roster and IDS hits. Do not interact or paste any commands.

Risk Factors (5)
Injected ClickFix/Win+X Terminal social-engineering overlay impersonating a Cloudflare security check (fake 'Ray ID', 'Authorize your browser now')
EtherHiding blockchain-contract-based payload loader contacting Polygon/Tenderly RPC endpoints
Obfuscated script concealing known-attacker hosts (polygon.gateway.tenderly.co, polygon.drpc.org, 1rpc.io)
Critical YARA matches and analyst-vetted malicious kit roster hits on the page body
Threat-intel match on the primary domain as a malware loader plus unranked third-party script host browse-codes-enter.beer
Domain age information unavailable

Details

Page Title

Grief Healing Book | Dr. Joan M. Hill

Scan Type

public

Domain Name Analysis

Domain 'wehavefeelingstoo.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. The core label 'wehavefeelingstoo' covers 17 characters split between eight vowels and nine consonants. Splitting it apart reveals four words: we, have, feelings, too. Median word length comes out to 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://wehavefeelingstoo.com

Page Load Overview

2.56s
Total Load Time
3.7 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:6,789 chars
Detector Agreement:100%

Website Classification

Primary Category

education learning85% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

education learning
85%
government public service
77%
healthcare medical
40%
corporate
35%
e-commerce shopping
26%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6174.138.176.150New York, New York, United States
AS19318Interserver, Inc
4104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4142.251.14.97Google · CDNUnited States
AS15169Google LLC
4172.66.157.232Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
435.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
4142.251.14.95Google · CDNUnited States
AS15169Google LLC
4192.178.183.94Google · CDNUnited States
AS15169Google LLC
4178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
4216.239.32.36Google · CDNUnited States
AS15169Google LLC
6616--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A553A572A3E402772A5A46D84014A31F99F2D11BDE166B40F3FC129BBFA6DD13873639

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:LCt5p8G6yprVNfcOOy/a+8bUC2Dir/tUvjl8Jy/FGpVcbVwHj0RF:XGzpVdbBvWJy/FGpKbVwD07

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:65514:AloLAMlBJKAeACEhTsJQr5cEIYxErXCINMBsKE0WKAijKQSJ0iEFiVloLYiMQGBAgQDkMwgQ1CQYRoiSg0RAPQQCQkiAoV8v

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:feff1000302080ff
Perceptual Hash:cad4f642967ec065
Difference Hash:c44a1171d1c12b6b
Wavelet Hash:fefff108114000ff
Color Hash:#c387c5

Scan History

Scan history not available

Unable to load historical scan data