Security Scan: Just a moment...

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/d2cbea4c-8a27-49b0-9cf7-ce32f9028e02 Domain and IP registration (RDAP)/api/v1/rdap/d2cbea4c-8a27-49b0-9cf7-ce32f9028e02 Certificate Transparency/api/v1/ct/fc2617cf.4346164a315335d9f00d2c36.workers.dev How often this domain was scanned/api/v1/domain/stats/fc2617cf.4346164a315335d9f00d2c36.workers.dev Scan history for this domain/api/v1/domain/history/fc2617cf.4346164a315335d9f00d2c36.workers.dev?limit=15

This website contacted 2 IPs in 1 country across 2 domains to perform 7 HTTP transactions. The main domain is fc2617cf.4346164a315335d9f00d2c36.workers.dev and was registered 7 years ago.

Submitted URL: https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/

AI Security Verdict

High Risk

Confidence: 88%

Risk Score

Confirmed malicious phishing kit: a fake Cloudflare 'Just a moment...' Turnstile gate (YARA + kit roster) on a workers.dev subdomain that impersonates Cloudflare and gates a credential-harvesting page. Avoid and report.

Risk Factors (6)

Known malicious phishing kit identified by analyst-vetted roster and YARA signature (turnstile-gate-kit-202609)

Fake Cloudflare security challenge / Turnstile gate impersonating Cloudflare branding

Self-hosted challenge form (cfForm / verifyCallback_CF) that gates delivery of a subsequent credential page

Hosted on a free instant-subdomain platform (workers.dev) on a randomized subdomain; actual page age unknown

Heavy use of eval() (68 calls) for dynamic code execution

Unranked in Cisco Umbrella with no legitimate reputation

Domain age information unavailable

Details

Page Title

Just a moment...secondary capture

Scan Type

public

Favicon Hash

MMH3: 780943526

MD5: 9d18f655b1ae77d6dbe44a41b6c67ebb

Domain Name Analysis

The domain 'fc2617cf.4346164a315335d9f00d2c36.workers.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'fc2617cf.4346164a315335d9f00d2c36'. The registrable portion 'workers' spans 7 characters with 2 vowels and five consonants. Tokenizing the label suggests 1 word: workers. Median word length comes out to 7 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.58s

Total Load Time

449 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:200 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical67% confidence

Type: static

Method: ml+structural

All Detected Categories

documentation technical

67%

government public service

63%

blog personal website

53%

news media journalism

49%

adult content

36%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.18.94.41Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	2	-	-

Detected Technologies4

Cloudflare Bot Management

70%

Cloudflare Turnstile

45%

HTTP/3

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A761963F6A21701AD6F38A7621F163DE3820E108DB03879AEE77A7444ED266A1E1174D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:PzTW4lNvkiWUZhbWYBUO36yKrnVjbv8+qfOcqwFtiGNirSVmu/sC7e4k5:PGeiUXtBUOXanFISch+rSOcg5

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:3318:ABg5AkABSIIczAEAIIQAIEACAAgAAQ4mgACEEAgACgAYAFIIAkgIhFAgAACABABKABAAIAAEAiMwUgSAAkAEGZEDAAApB0CA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc783c3ffffffe7

Perceptual Hash:b038c3cfc7cc6631

Difference Hash:00181e3600000008

Wavelet Hash:ffc7c3df30303c00

Color Hash:#d22dae

Other Hashes

Crop Resistant:00181e3600000008

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: fc2617cf.4346164a315335d9f00d2c36.workers.dev