dh2.googlesafebrowsingapi.workers.dev

Google

https://dh2.googlesafebrowsingapi.workers.dev Access site

Screenshot

No screenshot available yet Captured automatically on the next refresh cycle

Investigate

Domain dh2.googlesafebrowsingapi.workers.dev3 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 104.21.16.144

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://dh2.googlesafebrowsingapi.workers.dev

urlscan

Wayback

archive.today

Cert Google Trust Services

crt.sh

Censys

Google CT

Phishunt analysis Beta

25 low suspicionheuristic risk score · not a probability

Why?

+5.3 Keyword match
+5.1 Site cluster
+5.1 urlscan.io
+3.7 Brand in domain label
+1.1 ASN reputation
+1.1 No CSP header
+0.7 Brand in cert SAN
+0.6 Long domain
+0.6 Final host mismatch
+0.6 Suspicious TLD
+0.5 Young certificate
+0.3 Free CA
+0.3 Deep subdomain

17 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Site hosted on Cloudflare Workers impersonates Google Safe Browsing API via a deceptive subdomain. No legitimate Google outlinks are present and the resolved host diverges from the brand. Flagged malicious by urlscan, suggesting use in a broader phishing or credential-harvesting chain.

Brand in domain labelKeyword matchurlscan.io

AI-generated from stored detector signals - the AI never visited the site. · 2026-08-20 · confidence 55%

Domain & Network

Whois

Registrar CloudFlare, Inc.

Network

IP 104.21.16.144

Country