Security Scan Report: nebula.riolubro123.workers.dev

Redirected to:
https://github.com/MercuryWorkshop/scramjet
Submitted: Aug 14, 2026, 12:05:32 AMCompleted: Aug 14, 2026, 12:06:54 AMpubliccompleted
Loading additional data...

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 2 HTTP transactions. The main domain is github.com and was registered NaN years ago.

Submitted URL: https://nebula.riolubro123.workers.dev/github/scramjet

Effective URL: https://github.com/MercuryWorkshop/scramjetRedirected

AI Security Verdict

High Risk

Confidence: 78%

7
Risk Score

Low risk: no credential harvesting, legitimate redirect to GitHub, but high JS obfuscation and unknown subdomain age warrant caution.

Risk Factors
High JavaScript obfuscation score
Unknown subdomain age on a hosting platform
Multiple threat‑intel matches on loaded GitHub resources
Domain age information unavailable

Details

Page Title

GitHub - MercuryWorkshop/scramjet: Scramjet is a versatile web proxy designed to bypass internet censorship. · GitHub

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Category

technology software

(71%)

Domain Information

Within the developer-focused generic top-level domain (.dev), 'nebula.riolubro123.workers.dev' is registered with subdomain 'nebula.riolubro123'. The second-level label 'workers' is 7 characters long with 2 vowels and 5 consonants. Tokenizing the label suggests 1 word: workers. The median word length lands at seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://nebula.riolubro123.workers.dev/github/scramjet

Page Load Overview

6.74s
Total Load Time
180
HTTP Requests
8
Domains
1.8 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:en
Text Length:5,996 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software71% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
71%
forum community discussion
49%
documentation technical
42%
news/blog
20%

Detected Features

Articles
OG: object

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
45172.67.157.160Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
45185.199.108.133United States
AS54113Fastly, Inc.
45185.199.110.215United States
AS54113Fastly, Inc.
45140.82.121.4Frankfurt am Main, Hesse, Germany
AS36459GitHub, Inc.
1804--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17C64C5B1B075A23E015F168AF1B1AB54D3D7E28AD74958E2D13FC7B882D3C94F6A3049

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:39l+k98M7kNUREMP82ZitwKl3p3ZWJ4X4j1crHox30K8bhJMTAZf/Bd9RB1OPhvi:tl+k98M7+UREMP82ZitwKl3p3ZWJ4X4C

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:319519:Ai6UTICCSgCAPoIqukEQDEAILBYkxGEAko0ABpADpAE2EJosCEyiIEAaN1IKEUQCVCEghgEkBAAUqNkglZUIULSwFHSDIBgo

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00fffffffffffbff
Perceptual Hash:ed164a12126b7e6d
Difference Hash:4904324a4a034b23
Wavelet Hash:009283e3ababa9fb
Color Hash:#34862d

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data