Security Scan: Webmail Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a51e076c-7422-4c9b-8d10-77131029ca1b Domain and IP registration (RDAP)/api/v1/rdap/a51e076c-7422-4c9b-8d10-77131029ca1bHow often this domain was scanned/api/v1/domain/stats/w2-geiuhsewhoictwuhetiuhwie.cloudd1.workers.dev Scan history for this domain/api/v1/domain/history/w2-geiuhsewhoictwuhetiuhwie.cloudd1.workers.dev?limit=15

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://w2-geiuhsewhoictwuhetiuhwie.cloudd1.workers.dev

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Fake cPanel/Webmail login on a workers.dev subdomain that submits captured email+password cross-origin to an unrelated domain (airofreshintl.com) — a classic credential-phishing page. Do not enter credentials.

Risk Factors (4)

Cross-origin credential form submitting password + email to an unrelated domain (credential exfiltration)

Brand impersonation of a cPanel/webmail login portal on a non-official domain

Free/anonymous workers.dev hosting with unknown subdomain age

Domain unranked in Cisco Umbrella top 1M despite claiming to be a webmail service

Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Favicon Hash

MMH3: 428589171

MD5: 31eccd8848662931aa949469697b1f11

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'w2-geiuhsewhoictwuhetiuhwie.cloudd1.workers.dev' is registered with subdomain 'w2-geiuhsewhoictwuhetiuhwie.cloudd1'. The core label 'workers' covers 7 characters holding 2 vowels versus 5 consonants. Breaking it apart gives 1 word: workers. Average segment length settles at 7 characters. No strong language cues emerged from the frequency lists.