Security Scan: OpenRouter

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/5a2bc843-0890-48cf-baf7-1854afe20208 Domain and IP registration (RDAP)/api/v1/rdap/5a2bc843-0890-48cf-baf7-1854afe20208How often this domain was scanned/api/v1/domain/stats/calm-grass-5e42.gcdt.workers.dev Scan history for this domain/api/v1/domain/history/calm-grass-5e42.gcdt.workers.dev?limit=15

This website contacted 20 IPs in 1 country across 25 domains to perform 163 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: http://calm-grass-5e42.gcdt.workers.dev/

Effective URL:

https://calm-grass-5e42.gcdt.workers.dev/

Redirected

AI Security Verdict

Moderate Risk

Confidence: 62%

Risk Score

A complete copy of the OpenRouter site presented as OpenRouter on a random workers.dev subdomain, not the brand's official domain. No credential or payment form and no threat-intel hits, but the hostname is untrusted — do not sign up or enter API keys here.

Risk Factors (3)

Other entity's brand (OpenRouter) presented on a non-official domain

Hosted on an instant shared-hosting subdomain whose actual creation date is unknown and cannot be inferred from the platform apex age

Clone of a commercial login/API-key site placed on an untrusted hostname, so any 'Sign Up'/'Get API Key' flow could be redirected by whoever controls the subdomain

Safety Factors (4)

No password, payment or disguised credential fields present in the captured DOM

No Indicators of Compromise, hunting rule malware patterns, Safe Browsing hits or phishing/malware IDS signatures

Content includes full site structure, blog, footer and legal-style notices rather than a stripped login lure

Pagescripts contact the brand's own authentication backend (clerk.openrouter.ai) and reputable top-1M services, which is atypical for a throwaway phishing kit

Domain age information unavailable

Details

Page Title

OpenRouter

Scan Type

public

Favicon Hash

MMH3: 2110930207

MD5: 0c5e3d96b7096c89c27b98af811c5f47

Domain Name Analysis

Domain 'calm-grass-5e42.gcdt.workers.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'calm-grass-5e42.gcdt'. The second-level label 'workers' is 7 characters long split between two vowels and 5 consonants. Segmentation suggests one word: workers. Average segment length settles at 7 characters. No strong language cues emerged from the frequency lists.

Screenshot

Models ~ Rankings~ Oriv Benchmarks Chat Pricing Docs [Remus @ openrouter #8 ElevenLabs launch offer: every ElevenLabs model is 50% off through October 19, 2026. See ElevenLabs models x The Unified...

Page Load Overview

5.03s

Total Load Time

2.7 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:3,673 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software42% confidence

Type: spa

Method: ml+structural

All Detected Categories

technology software

42%

corporate

35%

cryptocurrency blockchain

34%

documentation technical

32%

Detected Features

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
11	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
8	104.18.34.146Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
8	142.251.14.97Google · CDN	United States	AS15169Google LLC
8	142.251.20.103Google · CDN	United States	AS15169Google LLC
8	216.239.34.36Google · CDN	United States	AS15169Google LLC
8	142.251.127.154Google · CDN	United States	AS15169Google LLC
8	142.250.154.94Google · CDN	United States	AS15169Google LLC
8	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
8	172.64.153.110Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
8	142.251.20.147Google · CDN	United States	AS15169Google LLC
163	20	-	-