Security Scan Report: dev1-server.sogal69343.workers.dev

Site favicon
Submitted: Sep 12, 2026, 3:34:55 PMCompleted: Sep 12, 2026, 3:36:32 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Multi-source malware Indicators of Compromise (APT UNC2465) name the scanned workers.dev host itself. Despite no visible forms or scripts, this is a flagged malware-distribution endpoint — do not visit or download anything.

Risk Factors (4)
Multi-source (2 independent feeds) content-malware Indicators of Compromise naming APT UNC2465 on the scanned primary domain
Malware-family attribution to a known threat actor that distributes remote-access/backdoor payloads
Disposable hosting-platform subdomain (workers.dev) with unknown, potentially minutes-old content
Empty, purpose-less page ('IIS7') consistent with a payload drop/staging endpoint
Domain age information unavailable

Details

Page Title

IIS7

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'dev1-server.sogal69343.workers.dev' is registered with subdomain 'dev1-server.sogal69343'. The second-level label 'workers' is 7 characters long containing 2 vowels alongside five consonants. Tokenizing the label suggests 1 word: workers. Median word length comes out to seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://dev1-server.sogal69343.workers.dev

Page Load Overview

5.70s
Total Load Time
183 KB
Total Size

Language Analysis

Primary Language

🏳️UNKNOWN
Code: unknown
Confidence:0%

Detection Details

Text Length:4 chars
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2104.21.57.157Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.67.146.226Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
32--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1460123684453424AE2D2C75461F1BE0478C1DB8BC5C6CE4CF8A2B026CF4474DF4223C8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12:hnM9iuXI9PG6QclfVI+MYaHwy0zt84rRNFD0bWEl0iy05exQ4xXEF9rDPObSCeFu:hM0mIJGsq+M3gNhoiM0oeu1PrTueo

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:676:AAAAgEgAAAAAAACAgAAAAAAAAAAAAAAAUAAAAAAAABAAAAAAgBAAABAAAAAAAAAAAAxAAAAAAgAAAACRAAAAAAAAAAABAQAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c3ffc3c3ffffffff
Perceptual Hash:e464ccce73333199
Difference Hash:16b2160c20040000
Wavelet Hash:c0d8c0c0f0f0f0f0
Color Hash:#87a2c5

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data