Security Scan: https://securedoc.mesuttgulerr573.workers.dev

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/56589452-6bdd-4b81-bb30-52c51fce9ed4 Domain and IP registration (RDAP)/api/v1/rdap/56589452-6bdd-4b81-bb30-52c51fce9ed4How often this domain was scanned/api/v1/domain/stats/securedoc.mesuttgulerr573.workers.dev Scan history for this domain/api/v1/domain/history/securedoc.mesuttgulerr573.workers.dev?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://securedoc.mesuttgulerr573.workers.dev/s?id=ab12cd34

AI Security Verdict

High Risk

Confidence: 93%

Risk Score

Plain-text Cloudflare Worker endpoint flagged by a CRITICAL hunting rule as a ClickFix malware stager; the returned body is PowerShell lure code, not a document. Do not open or run anything from this URL.

Risk Factors (4)

Critical-severity hunting-rule detection of a ClickFix malware stager (XaocMail) on the serving endpoint

Endpoint returns executable-delivery script text (PowerShell) instead of legitimate document content

Anonymous free-tier *.workers.dev subdomain with an unknown, unverifiable creation date

Lure uses fake 'secure document / access code' framing to induce the victim to run commands

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain 'securedoc.mesuttgulerr573.workers.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'securedoc.mesuttgulerr573'. Count 7 characters in 'workers' with 2 vowels and five consonants. Splitting it apart reveals 1 word: workers. No strong language cues emerged from the frequency lists.

Screenshot

# Placeholders (replaced by worker) : # = abl2cd34.—- Link ID # https: //securedoc.mesuttgulerr573.workers.dev - origin URL # 6 - lore # XXXX-KXX = access code $ErrorActionPreference = 'SilentlyC...

Page Load Overview

0.35s

Total Load Time

2 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

Text Length:2,081 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software51% confidence

Type: static

Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software

51%

documentation technical

44%

cryptocurrency blockchain

28%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	2	-	-

Detected Technologies2

HTTP/3

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12F41C95B915A50DD8B1133D1F88C6B89A4120027821FAF10737DD1C8EFB49BCD66D2DB

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:CvUDSjd81d1sBnVL629eKppfi8GCOqVp0epUYiyipHpm/RnVapgX:CvUDi9BnVjQ8UwdiyKHpmziW

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:2233:AQBAAAAAAQCAEAgABAgQAgAAAIIoACAIIIAQACAGAAAAUAACAAwBRAKAACWAAAAABAAAgAASAhIAgABAQAIAACgQAAAQIQQA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3f3f1f3f1f3f3f3f

Perceptual Hash:8540e30fe0ef3e3c

Difference Hash:e0f0f0c0f0f060f0

Wavelet Hash:1e3e0e2e1e1e1e1e

Color Hash:07000000000

Other Hashes

Crop Resistant:e0f0f0c0f0f060f0

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: securedoc.mesuttgulerr573.workers.dev