Security Scan Report: jn3cdjkapruvabqpfrvjslecoh.john-miller1only.workers.dev

Site favicon
Submitted: Completed: publiccompleted
This website contacted 2 IPs in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://jn3cdjkapruvabqpfrvjslecoh.john-miller1only.workers.dev

AI Security Verdict

Confirmed Scam

Confidence: 93%

10
Risk Score

Card-validation phishing kit on a throwaway workers.dev subdomain: collects card number, CVV and billing details while promising no charge, and posts them cross-origin to lifedesirefreen.com. Do not enter any data.

Risk Factors (6)
Cross-origin payment form action to lifedesirefreen.com, unrelated to the hosting domain
Harvests card number, CVV and expiry under a false 'validation only / no charge' pretext
Randomized subdomain on a shared developer hosting platform with unknown real age
Phishing threat-intelligence match on the primary domain (single-source, unverified)
Critical IDS alerts for a possible heap-spray/shellcode pattern on the page
No legitimate business identity, contact details or terms — only a 2023 copyright line
Domain age information unavailable

Details

Page Title

Welcome

Scan Type

public

Domain Name Analysis

The domain 'jn3cdjkapruvabqpfrvjslecoh.john-miller1only.workers.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'jn3cdjkapruvabqpfrvjslecoh.john-miller1only'. The registrable portion 'workers' spans 7 characters containing two vowels alongside five consonants. Word splitting yields one word: workers. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://jn3cdjkapruvabqpfrvjslecoh.john-miller1only.workers.dev

Page Load Overview

0.28s
Total Load Time
30 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:4,304 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking50% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

finance banking
50%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
22--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DBC33A3C3660DC5E4D7369BBFC682D54C455EF57ECC867C8780E82622FE2939B219286

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:AIiigD6dzii5wQCegfr3pi5xJO/dmLjvP7qi916qhL9xPQXOymwtxXheCVI8LH:VOi7WxtV1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:126724:U8AwBnqjDSGAICYzQsC+xTpCxBAUEYVAh0IgIUDfAywAIBFXOcQwYQECCUAgCMBEmQEEwAIDSIKIQQz6RlNCEFhGZhSARId0

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c2c3e7e7e7e7efe7
Perceptual Hash:f771233323938393
Difference Hash:0e0e484848486849
Wavelet Hash:0080e4e4e6e6eee7
Color Hash:07200018080

Other Hashes

Crop Resistant:0e0e484848486849

Scan History

Scan history not available

Unable to load historical scan data