Security Scan Report: 5eb23635.lodasaf228.workers.dev

Site favicon
Submitted: Jul 8, 2026, 8:50:32 PMCompleted: Jul 8, 2026, 8:53:28 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Fake Cloudflare 'Just a moment' Turnstile gate built with the known turnstile-gate-kit phishing kit on a throwaway workers.dev subdomain; the gate's hidden cfForm is designed to unlock a credential-harvesting stage. Avoid.

Risk Factors (5)
Known malicious phishing kit identified by analyst-vetted roster and YARA content anchor
Impersonation of Cloudflare's security challenge (fake Turnstile gate) on a non-Cloudflare domain
Hidden form (cfForm) designed to unlock and serve a second-stage credential page
Free hosting-platform subdomain with unknown creation date and no reputation ranking
Heavy use of eval() for obfuscated dynamic code execution
Domain age information unavailable

Details

Page Title

Just a moment...

Scan Type

public

Domain Name Analysis

You're looking at domain '5eb23635.lodasaf228.workers.dev' on the developer-focused generic top-level domain (.dev) with subdomain '5eb23635.lodasaf228'. Its registrable label 'workers' stretches across 7 characters split between two vowels and 5 consonants. Segmentation suggests one word: workers. Median word length comes out to seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://5eb23635.lodasaf228.workers.dev/

Page Load Overview

1.23s
Total Load Time
462 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:200 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical67% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
67%
government public service
63%
blog personal website
53%
news media journalism
49%
adult content
36%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
5188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3104.18.94.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
113--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12C61A63F6A21701AD2B38A7632F167DE3920E108C703879AEE77A7444DC26661F1174D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:jzTW4lNvkiWUZ8CbWYBUO36yKrnVjbv8+qfOcqwFtiGNirSVmu/sCYge4k5:jGeiU2CtBUOXanFISch+rSOngg5

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:3398:AQgACAICISAIgAEAAAAEAoggAAAAIICCYQOAgAAIEACAEAAARAQYBQQAEMgCAAABAARcBBRwAIKIABAEBEpAAAATAAAgKCQQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc7c7c3ffffffe7
Perceptual Hash:b838c3cfc64c6399
Difference Hash:001c1c3620000008
Wavelet Hash:3f0707033c3c3c00
Color Hash:#bf79d2

Other Hashes

Crop Resistant:001c1c3620000008

Scan History

Scan history not available

Unable to load historical scan data