Security Scan: Shared document

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/166983db-0602-457f-aaa5-10d8e1f04999 Domain and IP registration (RDAP)/api/v1/rdap/166983db-0602-457f-aaa5-10d8e1f04999How often this domain was scanned/api/v1/domain/stats/flow-note-zsgf.p-dthpnqnd.workers.dev Scan history for this domain/api/v1/domain/history/flow-note-zsgf.p-dthpnqnd.workers.dev?limit=15

This website contacted 4 IPs in 1 country across 2 domains to perform 13 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: http://flow-note-zsgf.p-dthpnqnd.workers.dev/http/sp13ct-surel-biz-vorik-danem.pages.dev

Effective URL:

https://flow-note-zsgf.p-dthpnqnd.workers.dev/http/sp13ct-surel-biz-vo...

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Fake 'Microsoft OneDrive shared document' page on a workers.dev subdomain that walks victims through entering a device code into a real Microsoft sign-in window. Safe Browsing and phishing threat intel both flag it - do not interact.

Risk Factors (6)

Brand impersonation of Microsoft/OneDrive on a non-Microsoft domain

Google Safe Browsing Social Engineering threat on the URL

Single-source threat-intel report classifying the URL as phishing

Device-code phishing pattern: fake shared-document page directing users to enter a code in a real Microsoft sign-in window

Cross-origin fetch to unranked api.lovewithoutlimits.surf; IDS HIGH alerts for *.surf HTTP traffic

Free instant-hosting subdomain (workers.dev) with unknown creation age

Domain age information unavailable

Details

Page Title

Shared document

Scan Type

public

Favicon Hash

MMH3: -479630384

MD5: a3e86e4cd040aa39e9232dc57f61ce3b

Domain Name Analysis

Domain 'flow-note-zsgf.p-dthpnqnd.workers.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'flow-note-zsgf.p-dthpnqnd'. The registrable portion 'workers' spans 7 characters split between 2 vowels and 5 consonants. Splitting it apart reveals one word: workers. Median word length comes out to seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.15s

Total Load Time

10 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:446 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software75% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

75%

documentation technical

71%

download file sharing

59%

government public service

48%

healthcare medical

43%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	172.67.167.107Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.21.67.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
13	4	-	-

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T192D106B2B2D9003AF997D0D2F530A7EB3450861BF59BCA10EAA57234D5C1DD36A35788

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:Tm0+dyOh89q/gnw8qMAzqp8KqArQKzvLsPuNXrBLJauvsPj5J1R6YpSU8oV4kG3:6Tn89q/7DMAeplQKzNXruhRRpSvPx3

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:6482:lguQDEkOeARocQBwRADASKAAZgEBIjEEiQFCAYqWMNAuBkjAAQgMBYAQZERQ4ZAABIQEhAApIuwWIBmQluAI0KoAQMkAkBPI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffffffffffffff

Perceptual Hash:9b1939666666666c

Difference Hash:1012382a2a2a1400

Wavelet Hash:00fcfcfc3c3c2030

Color Hash:#8c40bf

Other Hashes

Crop Resistant:10122a2a2a2a1400,0000004040408000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: flow-note-zsgf.p-dthpnqnd.workers.dev