Security Report: lokjagruktafoundation.org - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e84cf49b-5c93-4280-a364-8ac32476a7df Domain and IP registration (RDAP)/api/v1/rdap/e84cf49b-5c93-4280-a364-8ac32476a7dfHow often this domain was scanned/api/v1/domain/stats/lokjagruktafoundation.org Scan history for this domain/api/v1/domain/history/lokjagruktafoundation.org?limit=15

This website contacted 27 IPs in 2 countries across 19 domains to perform 105 HTTP transactions. The main domain is lokjagruktafoundation.org and was registered 6 years ago.

Submitted URL: https://lokjagruktafoundation.org

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Established NGO domain appears compromised: an injected ClickFix 'Human Verification' overlay (YARA/roster CRITICAL) tells Windows users to paste a PowerShell command, with EtherHiding blockchain-RPC exfiltration and a 2-feed malware IoC on the domain.

Risk Factors (5)

Injected ClickFix (Win+X → Terminal paste) 'Human Verification' overlay — analyst-vetted CRITICAL phishing kit

CRITICAL IDS alert: ET MALWARE EtherHiding Exfil M2

Page scripts connect to a blockchain RPC endpoint (rpc-mainnet.matic.quiknode.pro) used for payload retrieval

Primary domain match in threat intel as malware ('clearfake'), 2 independent feeds

Fake Cloudflare-style verification / Ray ID language instructing users to run a terminal command

Domain age information unavailable

Details

Page Title

Lok Jagrukta Foundation | Founder - Dr. Dipesh Batraother network

Scan Type

public

Favicon Hash

MMH3: 14350668

MD5: 60b1b8469613fef67a8198475c99504f

Domain Name Analysis

The domain name 'lokjagruktafoundation.org' uses the non-profit oriented generic top-level domain (.org) with no subdomain. Its registrable label 'lokjagruktafoundation' stretches across 21 characters split between 9 vowels and 12 consonants. Breaking it apart gives 5 words: lok, jagr, uk, ta, foundation. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

8.10s

Total Load Time

5.2 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:3,837 chars

Detector Agreement:60%

Website Classification

Primary Category

healthcare medical67% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

67%

corporate

35%

government public service

27%

news/blog

20%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
27	68.66.216.14	United States	AS55293A2 Hosting, Inc.
3	142.251.110.97Google · CDN	United States	AS15169Google LLC
3	146.75.120.157Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
3	142.251.110.95Google · CDN	United States	AS15169Google LLC
3	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
3	142.251.14.94Google · CDN	United States	AS15169Google LLC
3	132.145.155.63Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
3	142.251.153.4Google · CDN	United States	AS15169Google LLC
3	216.239.34.36Google · CDN	United States	AS15169Google LLC
3	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
105	27	-	-