Security Scan: Willkommen

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/787bb32b-000d-4bc9-b755-dbf6e8d687da Domain and IP registration (RDAP)/api/v1/rdap/787bb32b-000d-4bc9-b755-dbf6e8d687daHow often this domain was scanned/api/v1/domain/stats/gm64xhdjg723487yfhiuf34623452vf23.plathom.workers.dev Scan history for this domain/api/v1/domain/history/gm64xhdjg723487yfhiuf34623452vf23.plathom.workers.dev?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://gm64xhdjg723487yfhiuf34623452vf23.plathom.workers.dev/

AI Security Verdict

High Risk

Confidence: 72%

Risk Score

Random workers.dev subdomain displaying GMX branding with an 'update' lure and two CRITICAL IDS shellcode/heap-spray alerts; no forms found, but brand impersonation plus exploit-class network alerts make this unsafe.

Risk Factors (4)

Impersonation of a different entity's brand (GMX) on an unrelated random subdomain

Two CRITICAL IDS shellcode/heap-spray alerts indicating executable payload activity

Unranked host on a free shared-hosting namespace with unknown page age

Minimal 'update' lure page designed to look like a provider notice

Domain age information unavailable

Details

Page Title

Willkommen

Scan Type

public

Favicon Hash

MMH3: 357196185

MD5: 4bcebaf5b6140ef7c6b8f689e34214ac

Domain Name Analysis

You're looking at domain 'gm64xhdjg723487yfhiuf34623452vf23.plathom.workers.dev' on the developer-focused generic top-level domain (.dev) with subdomain 'gm64xhdjg723487yfhiuf34623452vf23.plathom'. Count 7 characters in 'workers' holding 2 vowels versus five consonants. Word splitting yields 1 word: workers. Expect 7 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.26s

Total Load Time

36 KB

Total Size

Language Analysis

Primary Language

🇸🇪Swedish

Code: sv

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

Text Length:39 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	2	-	-

Detected Technologies3

HTTP/3

40%

Cloudflare Bot Management

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T162539969B501DD4E7D23A8FFFCA82FD15414EE9BDDCCABC1404D582A6AE00AA351C1DB

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:eVbFZH8y0p9EOKanBGUSce7zclzE40oVTGj14dmGpsalsRcav7ylPXVexnOv3b/T:V3VvkqhCJqPV063b/+fnI

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:66411:aYDAggUIKaBEZ8EEYECBJVUxlVBiATgMmUIBSsoCIBFHDNCYDBagDgAioaEC8+hIRiwoVnCYdFJABQUDkEIArW7CBUCEIEvi

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:a5e7ffffffffffff

Perceptual Hash:b33333333333938c

Difference Hash:0c0c080000000000

Wavelet Hash:e7e7ffff00000000

Color Hash:#87c59d

Other Hashes

Crop Resistant:0c0c080000000000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: gm64xhdjg723487yfhiuf34623452vf23.plathom.workers.dev