Security Scan: IIS7

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/6f1ff16d-ad70-4edd-8b5f-556d162eec68 Domain and IP registration (RDAP)/api/v1/rdap/6f1ff16d-ad70-4edd-8b5f-556d162eec68How often this domain was scanned/api/v1/domain/stats/08f0.proxy-edge-c5f.workers.dev Scan history for this domain/api/v1/domain/history/08f0.proxy-edge-c5f.workers.dev?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 3 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://08f0.proxy-edge-c5f.workers.dev

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Workers.dev page with no real content (bare 'IIS7' banner) whose primary domain and parent domain are both multi-source threat-intel matches for APT UNC2465 malware infrastructure. Avoid entirely.

Risk Factors (4)

Indicators of Compromise on the primary (scanned) domain attributed to a named APT malware campaign

Second threat-intel match on the related parent domain, confirming dedicated malicious infrastructure

Contentless 'IIS7' placeholder page consistent with C2/proxy staging

Free instant-publish hosting subdomain with unknown creation date and no domain reputation

Domain age information unavailable

Details

Page Title

IIS7

Scan Type

public

Favicon Hash

MMH3: 1172844037

MD5: 19a7bd9efc19ad8ffb5600cd5fd0c36f

Domain Name Analysis

The domain name '08f0.proxy-edge-c5f.workers.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain '08f0.proxy-edge-c5f'. The core label 'workers' covers 7 characters containing two vowels alongside five consonants. Breaking it apart gives 1 word: workers. No strong language cues emerged from the frequency lists.