Security Scan Report: sd5hup4yo5vj7p5g35l36m843brzhpj.pages.dev

Site favicon
Submitted: Completed: publiccompleted
This website contacted 4 IPs in 1 country across 2 domains to perform 9 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://sd5hup4yo5vj7p5g35l36m843brzhpj.pages.dev

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Analyst-vetted Turnstile gate phishing kit forging a Cloudflare check on a random pages.dev subdomain, with a microsoftonline.com lure that hides a credential-harvesting page. Do not interact.

Risk Factors (5)
Fake Cloudflare 'Just a moment...' challenge rendered by the phishing kit with its own Turnstile widget and self-posting cfForm
Impersonation of Cloudflare bot protection and a Microsoft (microsoftonline.com) lure on a non-Microsoft domain
Anonymous hash-style subdomain on a free hosting platform with unknown, possibly minutes-old creation date
Anti-analysis gate: content is only served after passing the kit's own Turnstile callback
Inline scripts use encoding/decoding functions; obfuscated JavaScript IDS alert present
Domain age information unavailable

Details

Page Title

Just a moment...

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'sd5hup4yo5vj7p5g35l36m843brzhpj.pages.dev' is registered; it also runs on subdomain 'sd5hup4yo5vj7p5g35l36m843brzhpj'. Count 5 characters in 'pages' containing two vowels alongside three consonants. It segments into 1 word: pages. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://sd5hup4yo5vj7p5g35l36m843brzhpj.pages.dev

Page Load Overview

0.54s
Total Load Time
828 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:399 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software61% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
61%
documentation technical
35%
news media journalism
32%
government public service
31%
adult content
28%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3172.66.44.141Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.66.47.115Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.18.94.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
94--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FB02084414F11012666BC1BB22D6F7183EB8E02B490DCD583D9D93AC9F81FA29797BAD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:t51Vk86Nn7eIdhPTgbiXGYAoYQ/Wac/068Qoaz3mu+8cNd5:dVkvNVdq8QHyd5

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:8401:8UDmSSSABDbQAJAAAcJCFgEIq0ZHACSRsLZCoghYmhJAABhCDCkQSkEIaJBKugg0rTsIMkKxcpIEWNMYCAlEoA0woQLFASIG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffff8183efffff
Perceptual Hash:e64c99936c6c9393
Difference Hash:0022080f0f080000
Wavelet Hash:03034701c0e4fcfc
Color Hash:#79a4d2

Other Hashes

Crop Resistant:0022080f0f080000

Scan History

Scan history not available

Unable to load historical scan data