Security Scan: Shared Document

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/81ef83ac-08ee-46a8-9296-9a8fc97d36c7 Domain and IP registration (RDAP)/api/v1/rdap/81ef83ac-08ee-46a8-9296-9a8fc97d36c7How often this domain was scanned/api/v1/domain/stats/75df6039-6a04-17a3-c392-docviewer2.rajesh-das1010.workers.dev Scan history for this domain/api/v1/domain/history/75df6039-6a04-17a3-c392-docviewer2.rajesh-das1010.workers.dev?limit=15

This website contacted 2 IPs in 1 country across 6 domains to perform 11 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://75df6039-6a04-17a3-c392-docviewer2.rajesh-das1010.workers.dev/w81pm72ut55/ywzf6zchl

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Microsoft-branded device-code phishing page on a workers.dev subdomain using a fake shared-document/invoice lure to trick users into authenticating and handing over account access. Do not interact.

Risk Factors (5)

Impersonation of Microsoft sign-in on a domain that is not Microsoft's

Device-code phishing prompt: tells users to copy a code and authenticate, enabling account takeover

Fake 'shared document' / invoice pretext used as bait

Unattributable free hosting subdomain with no domain reputation

Social-engineering urgency elements ('Code expires in 14:02', payment/wire-transfer lure)

Domain age information unavailable

Details

Page Title

Shared Document

Scan Type

public

Domain Name Analysis

The domain '75df6039-6a04-17a3-c392-docviewer2.rajesh-das1010.workers.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain '75df6039-6a04-17a3-c392-docviewer2.rajesh-das1010'. The core label 'workers' covers 7 characters split between 2 vowels and five consonants. It segments into one word: workers. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.73s

Total Load Time

272 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:3,248 chars

Detector Agreement:50%

Website Classification

Primary Category

technology software97% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

97%

documentation technical

78%

corporate business

29%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
6	142.251.110.95Google · CDN	United States	AS15169Google LLC
5	172.67.212.40Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
11	2	-	-

Detected Technologies3

HTTP/3

40%

Cloudflare Bot Management

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D9232A3163F1012AB85395907FABAF1B7224E103C50689757AED52C4CFCE9E6E9A734C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:Brt8VQFbzSRvJ+qFPPPUV1jUeM2ixOaQsHXtsMHQCxWhQ/oReger0OpZ+NyTcokF:vpFgFHujtdsm3ehYOpZYokYw/5HLqQGS

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:47094:SAuJE0UFCGYAggEFEwiIIEBKIBGjAxgOICED4IEPUhXSiBUfEIEMkrhSsVE7gOAA6AQwdG8soIACEjOIClDMAQQDAiYQEsEo

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff18181818181800

Perceptual Hash:889173e2f2d8d1d9

Difference Hash:8e33b3b3b3b3b3cd

Wavelet Hash:ff191d1d19191939

Color Hash:#6ce089

Other Hashes

Crop Resistant:8e33b3b3b3b3b3cd,70dcdcdcd4d4d413,5c32b2b2b2b2b3cd,61616969696b6161,ccf4dcdcb2aac0b2

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: 75df6039-6a04-17a3-c392-docviewer2.rajesh-das1010.workers.dev