Security Report: nextcloudproxy.norosam.workers.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/968e9b7c-e7b5-4cb3-9530-de270ba690c7 Domain and IP registration (RDAP)/api/v1/rdap/968e9b7c-e7b5-4cb3-9530-de270ba690c7How often this domain was scanned/api/v1/domain/stats/nextcloudproxy.norosam.workers.dev Scan history for this domain/api/v1/domain/history/nextcloudproxy.norosam.workers.dev?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 28 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: http://nextcloudproxy.norosam.workers.dev/

Effective URL:

https://nextcloudproxy.norosam.workers.dev/

Redirected

AI Security Verdict

Moderate Risk

Confidence: 60%

Risk Score

Self-hosted Nextcloud login on an anonymous workers.dev proxy subdomain. No threat-intel, hunting rule, exfiltration or cross-origin form signals, but the operator and page age are unverifiable, so credentials should only be entered if the host is trusted.

Risk Factors (3)

Credential-collecting login form on an instant, anonymous shared-hosting subdomain with no attributable owner or creation date

'proxy' style hostname suggests a reverse-proxy front for a backend Nextcloud instance whose operator cannot be verified from the page

Cisco Umbrella has no ranking for the host, so the operator's identity and history are unverifiable

Safety Factors (4)

Form action is same-origin (/login); no cross-origin form submission and no credential exfiltration observed

No payment fields, no disguised or orphan password fields, and no unicode confusion

Nextcloud's default self-hosted login layout and branding (open-source software), including requesttoken CSRF field — consistent with a genuine self-hosted instance rather than a copied kit

No Indicators of Compromise, hunting-rule hits, malicious JavaScript behaviour, or phishing/malware IDS signatures

Domain age information unavailable

Details

Page Title

Scan Type

public

Favicon Hash

MMH3: -90671692

MD5: 97b7385cdcb4c91fcec219cebde2ac65

Domain Name Analysis

The domain name 'nextcloudproxy.norosam.workers.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'nextcloudproxy.norosam'. The registrable portion 'workers' spans 7 characters split between 2 vowels and five consonants. Splitting it apart reveals 1 word: workers. Median word length comes out to 7 characters. No strong language cues emerged from the frequency lists.