Security Scan Report: 3147459c.92ea2438071f378d2627edbe.workers.dev

Site favicon
Submitted: Sep 29, 2026, 1:53:52 AMCompleted: Sep 29, 2026, 1:54:28 AMpubliccompleted

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

High-risk phishing gate: an analyst-vetted fake Cloudflare 'Just a moment' Turnstile kit on a workers.dev subdomain, flagged by a high-precision YARA rule and two CRITICAL ET PHISHING IDS alerts. Do not proceed or enter any data.

Risk Factors (5)
Known phishing kit identified by analyst-vetted roster and YARA (Turnstile gate / cfForm)
Impersonation of Cloudflare's security-challenge page on a non-Cloudflare domain
Two CRITICAL network IDS phishing alerts (credential phishing landing page)
Self-hosted Turnstile gate used to filter automated crawlers before serving the credential page
Unranked shared-hosting subdomain with obfuscated hex-style label, no legitimate reputation
Domain age information unavailable

Details

Page Title

Just a moment...secondary capture

Scan Type

public

Domain Name Analysis

You're looking at domain '3147459c.92ea2438071f378d2627edbe.workers.dev' on the developer-focused generic top-level domain (.dev); it also runs on subdomain '3147459c.92ea2438071f378d2627edbe'. The core label 'workers' covers 7 characters split between 2 vowels and 5 consonants. Splitting it apart reveals one word: workers. Median word length is 7 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://3147459c.92ea2438071f378d2627edbe.workers.dev/

Page Load Overview

0.49s
Total Load Time
784 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:199 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical68% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
68%
government public service
66%
blog personal website
55%
news media journalism
52%
adult content
38%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.18.94.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
84--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T156C1B61B2EF220559263A47629F393597924F00B9206CB95BE6F67844FC263A4F9378C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:PeyE+40WB0PeyMa54SlpRsWYyXA6yWiXanFISch+rsfsjeO7N:PeyE+40WB0GyMa54SDRsWYyXdympbrsS

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:5869:KQlCCgBQCAFCAgBQAIK1EAgQoQqfCQoEBEFAQoAMBELKCBKIhGmhCQcECWihEAAhAhwSCaJkaRIWBBQgoBCCJQAApSAEayFA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffcfc7c3ffffffe7
Perceptual Hash:b038c3cfc7643399
Difference Hash:00181c1600000008
Wavelet Hash:3f0707030f0f3f03
Color Hash:#2dd29e

Other Hashes

Crop Resistant:00181c1600000008

Scan History

Scan history not available

Unable to load historical scan data