ScanMalware.com

Security Scan Report: wahala-er-98gzp-0031f4.am2om247.workers.dev

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/5e6b2eb0-9bce-4ba2-ba8c-56bdea7979e5Domain and IP registration (RDAP)/api/v1/rdap/5e6b2eb0-9bce-4ba2-ba8c-56bdea7979e5How often this domain was scanned/api/v1/domain/stats/wahala-er-98gzp-0031f4.am2om247.workers.devScan history for this domain/api/v1/domain/history/wahala-er-98gzp-0031f4.am2om247.workers.dev?limit=15
This website contacted 2 IPs in 1 country across 1 domain to perform 14 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://wahala-er-98gzp-0031f4.am2om247.workers.dev/?k=kQNzCfXXwkgl2idjUPLYsXXH

AI Security Verdict

High Risk

Confidence: 78%

8
Risk Score

Page displays the DocuSign brand on a non-DocuSign workers.dev subdomain, with a 'verify your session' lure and anti-analysis JS cloaking. No credential form captured, but the brand impersonation and cloaking make it high-risk.

Risk Factors (4)
Impersonation of the DocuSign brand on a non-DocuSign workers.dev subdomain
Anti-analysis JavaScript (context-menu blocking, 3 anti-analysis techniques)
Obfuscated 'verifying visit / checking your connection' interstitial typical of phishing kit cloaking
Randomized throwaway subdomain on a free hosting platform with no reputation
Domain age information unavailable

Details

Page Title

DocuSign | Action Required: Identity Verification

Scan Type

public

Domain Name Analysis

The domain 'wahala-er-98gzp-0031f4.am2om247.workers.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'wahala-er-98gzp-0031f4.am2om247'. The second-level label 'workers' is 7 characters long split between 2 vowels and 5 consonants. Word splitting yields one word: workers. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://wahala-er-98gzp-0031f4.am2om247.workers.dev/?k=kQNzCfXXwkgl2idjUPLYsXXH

Page Load Overview

3.75s
Total Load Time
216 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:223 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical71% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
71%
government public service
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
142--

Detected Technologies4

HTTP/3
40%
HSTS
40%
Cloudflare Bot Management
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14D23D82FF904D81EC9836D4E267FAD3A305EC06E03C1A62D55DDC65C06928BCEBA35C6

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:wGdzkjCjickk+Cqur+y6z6PNYhhsRH6P0XSIpg1DgOrIwEmZbuesZzoZlQCC0Mlt:ankPesRaPiPu1DDrIwEqb1sZzk2JLZ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:46055:i5mkDDzmIKACAiAmFCwhxojKFgBBIBxUIEQQVGxDlIUQcKgSawbiBEKBasIyh3Eg8gA0IEHMdFIyWwFpjEBSRyBQRAgYCiQR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe7e7ffffff
Perceptual Hash:b38bcc64339bcc64
Difference Hash:0000000808000000
Wavelet Hash:f0f0f4e4e0f0f0f0
Color Hash:#86672d

Other Hashes

Crop Resistant:0000000808000000

Scan History

Scan history not available

Unable to load historical scan data