ScanMalware.com

Security Scan Report: accounts-fe50ccd9.jkhjkjk.workers.dev

Redirected to:
https://accounts-fe50ccd9.jkhjkjk.workers.dev/?naps=&sid=KecJE4E01AfIL...
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a00f7f41-62e0-4f1e-b704-63bbbaf5e9ddDomain and IP registration (RDAP)/api/v1/rdap/a00f7f41-62e0-4f1e-b704-63bbbaf5e9ddCertificate Transparency/api/v1/ct/accounts-fe50ccd9.jkhjkjk.workers.devHow often this domain was scanned/api/v1/domain/stats/accounts-fe50ccd9.jkhjkjk.workers.devScan history for this domain/api/v1/domain/history/accounts-fe50ccd9.jkhjkjk.workers.dev?limit=15
This website contacted 2 IPs in 1 country across 2 domains to perform 3 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://accounts-fe50ccd9.jkhjkjk.workers.dev/?naps

Effective URL:
https://accounts-fe50ccd9.jkhjkjk.workers.dev/?naps=&sid=KecJE4E01AfIL...
Redirected

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Page mimics Excel login, collects credentials on an unknown subdomain; high risk of phishing.

Risk Factors (4)
Brand impersonation on unknown‑age subdomain
Credential collection form
Anti‑analysis JavaScript (devtools/right‑click blocking)
Unranked domain with no reputation
Domain age information unavailable

Details

Page Title

Excel - Shared Document

Scan Type

public

Domain Name Analysis

The domain name 'accounts-fe50ccd9.jkhjkjk.workers.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'accounts-fe50ccd9.jkhjkjk'. Count 7 characters in 'workers' split between two vowels and 5 consonants. Tokenizing the label suggests one word: workers. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://accounts-fe50ccd9.jkhjkjk.workers.dev/?naps

Page Load Overview

0.66s
Total Load Time
41 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:54%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:zh
Text Length:214 chars
Detector Agreement:67%
Language mismatch: Declared as zh but detected as en

Website Classification

Primary Category

suspicious phishing25% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

suspicious phishing
25%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.64.149.246Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
32--

Detected Technologies3

HTTP/3
40%
Cloudflare Bot Management
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FFD22A2A66C224B993D7C97A71EF3B1870B49403CD538A108879E53D51E7D8BF732BA4

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:XkLXlDyuXabN73hhS1zII7fQIIi6aqxIIIIHA3IfBLbTHwanXl:XkzRyuOp+1zII7fQIIi6aqxIIIIHA3Iz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:30494:Agx4ClLjYBEMRJEpgGFOAIAwWEAxA7M4AJpsEAcOq2KBYYCA4EAFoFhAk6RBp9AAoUUCKASBACQI8ACkxMEiGIgiUUDDnAQA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0018001818180000
Perceptual Hash:9966669999666633
Difference Hash:08304cb2b22a0400
Wavelet Hash:0f0f273f3c3c3030
Color Hash:#7a2dd2

Other Hashes

Crop Resistant:08304cb2b22a0400

Scan History

Scan history not available

Unable to load historical scan data