ScanMalware.com

Security Scan Report: 116ec3a1ad128d7d.darkwebf.workers.dev

Site favicon
Submitted: Sep 12, 2026, 3:34:00 PMCompleted: Sep 12, 2026, 3:34:37 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Domain carries a multi-source malware/phishing-kit Indicator of Compromise (eviltokens/jalisco) and the page impersonates Microsoft SharePoint with a remittance-advice lure on a throwaway workers.dev subdomain. Treat as phishing; do not enter credentials.

Risk Factors
Multi-source corroborated content-malware Indicator of Compromise on the page's own primary domain (eviltokens/jalisco)
Impersonation of Microsoft SharePoint (remittance-advice lure) on a non-Microsoft, throwaway workers.dev subdomain
Page served from a shared hosting platform namespace with an unknown tenant creation date (apex age not attributable to this page)
Known phishing-kit family indicator combined with a finance-themed document lure is a classic credential/token harvest pattern
Domain age information unavailable

Details

Page Title

SharePoint - Remittance Advice

Scan Type

public

Domain Name Analysis

Domain '116ec3a1ad128d7d.darkwebf.workers.dev' uses the developer-focused generic top-level domain (.dev) with subdomain '116ec3a1ad128d7d.darkwebf'. The registrable portion 'workers' spans 7 characters split between 2 vowels and five consonants. Word splitting yields 1 word: workers. Median word length comes out to 7 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://116ec3a1ad128d7d.darkwebf.workers.dev

Page Load Overview

0.66s
Total Load Time
23 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:30 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1172.67.129.54Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.67.74.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.21.1.122Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
55--

Detected Technologies3

HTTP/3
40%
Cloudflare Bot Management
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C4435C03117B5192B49390A97B92FA4E176A4C138176DF193A7D7B08CF80ED58B93BBC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:YMnB6qkVpzyGL+aZMO8oHxBjvFbi+xPjxrvYnpDqWVfY4qG4:YMB6JzyGLVZlRlFO+vrgRfY4W

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:55943:AhCAUFSt0ggAYJEHAKSAApRoUCAtAATRkNXRTAGgawAYwXAxZWMRJFbKjKOAcw+BpyQACBvEIASwAKGoS5UKAMEiDQBoAQAo

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:N/A
Perceptual Hash:N/A
Difference Hash:N/A
Wavelet Hash:N/A
Color Hash:N/A

Other Hashes

Crop Resistant:N/A

Scan History

Scan history not available

Unable to load historical scan data