Security Scan: Webmail Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/8fe772c2-8d0f-446e-b148-291c601fb3f6 Domain and IP registration (RDAP)/api/v1/rdap/8fe772c2-8d0f-446e-b148-291c601fb3f6How often this domain was scanned/api/v1/domain/stats/w22-fghkdjgkvdfhgvdfkgss.joy-hughes.workers.dev Scan history for this domain/api/v1/domain/history/w22-fghkdjgkvdfhgvdfkgss.joy-hughes.workers.dev?limit=15

This website contacted 3 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://w22-fghkdjgkvdfhgvdfkgss.joy-hughes.workers.dev

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Fake cPanel webmail login on a throwaway workers.dev subdomain that posts victim email and password cross-origin to a hidden PHP endpoint on a compromised WordPress site (airofreshintl.com) — a textbook credential phishing page. Do not enter any credentials.

Risk Factors (5)

Cross-origin credential form (password + email) posting to an unrelated domain (airofreshintl.com)

Form action path is a concealed random-named PHP endpoint inside a compromised WordPress installation

Impersonation of a webmail/cPanel login interface not belonging to the hosting domain

Disposable, unranked workers.dev subdomain with an obfuscated random name

Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Favicon Hash

MMH3: 1946489983

MD5: 15385e34c77d0998acf1f2f57bcbff2d

Domain Name Analysis

You're looking at domain 'w22-fghkdjgkvdfhgvdfkgss.joy-hughes.workers.dev' on the developer-focused generic top-level domain (.dev) with subdomain 'w22-fghkdjgkvdfhgvdfkgss.joy-hughes'. The registrable portion 'workers' spans 7 characters holding 2 vowels versus 5 consonants. Tokenizing the label suggests one word: workers. Median word length is seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.96s

Total Load Time

110 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:938 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software49% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

49%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	172.67.201.135Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	103.104.196.106	Singapore, Singapore	AS58621Vodien Internet Solutions Pte Ltd
3	104.21.66.63Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	3	-	-