Security Scan Report: registro-cita-digital-aregb-2026.cr-web.workers.dev

Submitted: Completed: publiccompleted
This website contacted 2 IPs in 1 country across 1 domain to perform 19 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: https://registro-cita-digital-aregb-2026.cr-web.workers.dev

AI Security Verdict

High Risk

Confidence: 76%

7
Risk Score

Page poses as Costa Rica's national digital-certification service and pushes users to 'Registrarse', but lives on a free workers.dev subdomain with a spoofed government-style hostname. No form fields captured here, but the government impersonation makes it unsafe to use.

Risk Factors (5)
Impersonation of a national government digital-certification service on a non-official domain
Free/shared hosting subdomain (workers.dev) with a targeted, official-sounding name
Deceptive hostname including a year and government-style acronym (aregb-2026) to appear authoritative
Registration call-to-action designed to move users into submitting personal data
Unranked domain with no verifiable affiliation to any Costa Rican public institution
Domain age information unavailable

Details

Page Title

Citas CR

Scan Type

public

Domain Name Analysis

The domain name 'registro-cita-digital-aregb-2026.cr-web.workers.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'registro-cita-digital-aregb-2026.cr-web'. Its registrable label 'workers' stretches across 7 characters with two vowels and 5 consonants. It segments into 1 word: workers. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://registro-cita-digital-aregb-2026.cr-web.workers.dev

Page Load Overview

11.95s
Total Load Time
430 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:43%
Script:Latin
Direction:ltr

Detection Details

Text Length:105 chars
Detector Agreement:50%

Website Classification

Primary Category

cryptocurrency blockchain59% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
59%
phishing scam
59%
adult content
51%
government public service
50%
finance banking
47%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10104.21.33.193Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9172.67.191.247Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
192--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15A5141D2DD4BCE3A04176D9DB41BAF1EA44AC52EC978884CB6FCD59C02A5F9E0E0ED44

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:Xsz4GoGmeq7OPQdjuMHTay7CC767aYlpGdHmk4U9AtydEPKjMo340o3/SRv0ZlBC:XlPCq7uxiYjxk46SydEoQSRv0v1nu

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:2681:gACAgQAQBAAAgQJYMIAAgAAQcACDIAAAAAAAAAAAAAAAABBRgEAAAhBhCmDYAjAAIgIAAwAABgABAAABIAgAAAKFkEAAAAEA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff00761001456040
Perceptual Hash:e2bed5aad9c4c0c1
Difference Hash:4d0d84e5918d8cde
Wavelet Hash:ff01771341f76242
Color Hash:#d279c1

Scan History

Scan history not available

Unable to load historical scan data