blue-night-ba2c.gradwest03.workers.dev
Category: Software Download
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of blue-night-ba2c.gradwest03.workers.dev
This domain appears to be a Cloudflare Workers-hosted page rather than a primary branded website. Based on the screenshot, it presents itself as an Adobe Acrobat Reader download page and prompts the visitor to complete a human-verification step before downloading a Windows installer file. The hostname structure under workers.dev suggests it may be a custom worker deployment or temporary landing page rather than an official corporate domain.
The page content appears focused on software distribution, specifically offering a file download labeled as an installer. However, the domain itself does not appear to be an official Adobe-owned web property, and no clear operator identity is visible from the provided scan data. That combination may indicate a promotional, intermediary, or imitation download landing page rather than a standard vendor-operated software page.
Safety Assessment for blue-night-ba2c.gradwest03.workers.dev
At the time of this scan, automated security checks were largely clean: 0 out of 92 security engines flagged the domain, the malware scan reported no flagged files, and major threat-database checks did not report active phishing or malware listings. The domain is also several years old, which can be a mildly reassuring signal in isolation. However, one blacklist provider did list the domain with a generic malicious-object label, so the reputation picture was not entirely clean at the time of review.
The larger concern comes from the page behavior and presentation rather than from malware-engine consensus. The site appears to imitate an Adobe download page while operating from a workers.dev subdomain that does not appear to be an official Adobe domain. It also places a verification prompt in front of a software download, which is a pattern sometimes associated with misleading download pages or social-engineering lures. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid Let's Encrypt SSL certificate with expiry shown as 2026-12-17 and is served through Cloudflare infrastructure on IP address 104.21.26.89. Hosting and nameserver data both point to Cloudflare, and the page references a Cloudflare Turnstile challenge script. DNSSEC appears to be unsigned.
From an infrastructure perspective, the setup appears modern and functional, but the use of a Cloudflare Workers subdomain for a branded software-download page may reduce attribution clarity. No direct malware payloads were flagged in the limited file scan, but the mismatch between the apparent brand being presented and the hosting domain is a technical trust concern.
Share your experience with this website. Was it safe? Did you encounter any issues?