Security Report: ysk-8sahzjsn-82ab8f.ellen-4c2.workers.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/c0a5be44-21d8-4adf-adeb-a0d071d0828a Domain and IP registration (RDAP)/api/v1/rdap/c0a5be44-21d8-4adf-adeb-a0d071d0828aHow often this domain was scanned/api/v1/domain/stats/ysk-8sahzjsn-82ab8f.ellen-4c2.workers.dev Scan history for this domain/api/v1/domain/history/ysk-8sahzjsn-82ab8f.ellen-4c2.workers.dev?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 11 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://ysk-8sahzjsn-82ab8f.ellen-4c2.workers.dev/?access=r9ZkOgjoMENFN_yzOdXfG2D7

AI Security Verdict

High Risk

Confidence: 78%

Risk Score

DocuSign/Microsoft-branded page on an unofficial workers.dev subdomain with access-gate and anti-analysis behavior; no credential form captured, but brand misuse is suspicious.

Risk Factors (3)

Brand impersonation of DocuSign/Microsoft on a non-official workers.dev domain

Anti-analysis behavior including right-click blocking and detected anti-analysis techniques

Access-gate wording that may be used to filter automated review before showing phishing content

Domain age information unavailable

Details

Page Title

DocuSign — Review and sign

Scan Type

public

Domain Name Analysis

You're looking at domain 'ysk-8sahzjsn-82ab8f.ellen-4c2.workers.dev' on the developer-focused generic top-level domain (.dev); it also runs on subdomain 'ysk-8sahzjsn-82ab8f.ellen-4c2'. The registrable portion 'workers' spans 7 characters with 2 vowels and 5 consonants. Breaking it apart gives one word: workers. Median word length comes out to seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.09s

Total Load Time

161 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:86 chars

Detector Agreement:100%

Website Classification

Primary Category

news media journalism47% confidence

Type: spa

Method: ml+structural+ocr_tiebreaker

All Detected Categories

news media journalism

47%

healthcare medical

45%

adult content

41%

government public service

35%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
6	172.67.191.51Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	104.21.41.139Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
11	2	-	-

Detected Technologies5

WordPress

75%

HTTP/3

40%

HSTS

40%

Cloudflare Bot Management

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T11723952FF955DC0EC6836D4E267B6C3A310DC46E03C1AA6D998DC65C02925BCEBE75C2

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:CojumH/QSoetEJ16OlJnqohEsbpB4DgOrIwEmZbuesZzlQ8/0t1bMJn9SpdVr3d8:nQeEn0sb74DDrIwEqb1sZz280r4nwTV2

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:46246:WoAAA8JAZoldIlXNlWWkBiBBcKAaAlBIYAIV0SJCqKACChUSUCMCIoYwQCA2YdNNIWJswxERSKQAhQQEqYQiG1SiigvBSBVA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe7e7ffffff

Perceptual Hash:b399cc263399cccc

Difference Hash:0000000808000000

Wavelet Hash:3c3c0404e4e4fcfc

Color Hash:#78533a

Other Hashes

Crop Resistant:0000000808000000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: ysk-8sahzjsn-82ab8f.ellen-4c2.workers.dev