Security Scan Report: 6688.27527638.workers.dev

Redirected to:
https://www.xuexi.cn/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 33 IPs in 3 countries across 9 domains to perform 435 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: http://6688.27527638.workers.dev/xwfb/bldhd/art/2026/art_ad9f71a8dd3f4ec4a8b045d02823042a.html

Effective URL:
https://www.xuexi.cn/
Redirected

AI Security Verdict

Moderate Risk

Confidence: 62%

5
Risk Score

Dead link: an anonymous .workers.dev subdomain redirects to a Cloudflare Error 1016 page for mail.gov.cn. No forms, no impersonation, no threat-intel or malware hits — nothing malicious is served, but the host has no reputation and the link is broken.

Risk Factors (3)
Opportunistic anonymous subdomain on a free hosting platform (.workers.dev) whose actual creation date is unknown
Cross-domain redirect chain (workers.dev -> xuexi.cn) ending on a broken/error page rather than the requested article path
Domain not present in Cisco Umbrella top 1M — no established reputation for the entry host
Safety Factors (2)
Content served is a standard Cloudflare error/troubleshooting page, not a brand-impersonating login or offer page
Cross-origin request observed is to a ranked Alibaba Cloud telemetry host (arms-retcode.aliyuncs.com, #42,732), a common analytics endpoint
Domain age information unavailable

Details

Page Title

Origin DNS error | mail.gov.cn | Cloudflare

Scan Type

public

Domain Name Analysis

Domain '6688.27527638.workers.dev' uses the developer-focused generic top-level domain (.dev) with subdomain '6688.27527638'. Its registrable label 'workers' stretches across 7 characters with 2 vowels and 5 consonants. Splitting it apart reveals one word: workers. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://6688.27527638.workers.dev/xwfb/bldhd/art/2026/art_ad9f71a8dd3f4ec4a8b045d02823042a.html

Page Load Overview

15.14s
Total Load Time
37.1 MB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:71%
Script:Han
Direction:ltr

Detection Details

HTML Lang Attribute:cmn-Hans
Text Length:7,208 chars
Detector Agreement:100%
Language mismatch: Declared as cmn-Hans but detected as zh

Website Classification

Primary Category

education learning60% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

education learning
60%
travel tourism
60%
government public service
53%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
19104.21.26.135Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13104.18.30.78Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13104.17.208.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13151.101.193.229Fastly · CDNUnited States
AS54113Fastly, Inc.
13185.111.111.156Frankfurt am Main, Hesse, Germany
AS212238Datacamp Limited
13108.138.7.13Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
13104.18.26.232Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1323.50.131.156Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
13146.75.121.194Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
1334.111.241.208Google · CDNKansas City, Missouri, United States
AS396982Google LLC
43533--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13502A8B3F1F8553A0043C39275B97B2D79A690179BB208E57E5E41725F8EF92F903244

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:ljHjDjuna/daa7lOzz2zlfgP60iTndvieJi0qyAkCeK5sLsX:ia/EgOufwRiTndvieqz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:8258:wUKSVEIiAxgEMEYkFKGKMUHCwRVDBgzAsEFyAKVBBlYlheyCihiqEQFEKTYALABhAWiKRMKgEIKBJIjEYAYwAGIIHKhQhSoC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c7cfcfcfcfc7e7ff
Perceptual Hash:b838c7361867b339
Difference Hash:1c341838380c0e00
Wavelet Hash:000c848c8f87033f
Color Hash:#782d86

Other Hashes

Crop Resistant:1c341838380c0e00

Scan History

Scan history not available

Unable to load historical scan data