Security Scan Report: pub-d32e1723091e4c74b19f3caea6a4ed0a.r2.dev

Site favicon
Submitted: Completed: publiccompleted
This website contacted 6 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-d32e1723091e4c74b19f3caea6a4ed0a.r2.dev/qiye-revised/index.html

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Login page impersonating NetEase Enterprise Mail on an anonymous Cloudflare R2 bucket, capturing email and password. Brand impersonation plus credential form on cloud storage — do not enter credentials.

Risk Factors (5)
Impersonation of NetEase Enterprise Mail brand on a domain unrelated to 163.com
Credential login form (email + password) hosted on a public R2 storage bucket
Anonymous, disposable cloud-storage hosting inconsistent with a major brand login
Unranked domain with no attributable registration age
Login page lacks any legitimate branding/legal/company information typical of the real service
Domain age information unavailable

Details

Page Title

网易企业邮箱 - 登录入口

Scan Type

public

Domain Name Analysis

Domain 'pub-d32e1723091e4c74b19f3caea6a4ed0a.r2.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'pub-d32e1723091e4c74b19f3caea6a4ed0a'. The second-level label 'r2' is 2 characters long split between 0 vowels and 1 consonant, along with 1 digit. Segmentation suggests 2 words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

邮箱帐号登录 今夏 邮,你 / DRESS FAP SO IAL 赠送域名 “一站式开通 RBA ) 鲁 ) @ 正使用全程SSL 管理员登录 F a

Page Load Overview

0.41s
Total Load Time
227 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:13 chars
Detector Agreement:0%

Website Classification

Primary Category

finance banking62% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

finance banking
62%
adult content
33%
government public service
28%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1103.126.92.249Hong Kong
AS137263NETEASE HONG KONG LIMITED
1104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1103.126.92.250Hong Kong
AS137263NETEASE HONG KONG LIMITED
66--

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1546184A67CA962653AB300F520F7969C155DD1027708C840F07CB6C9AF95FC97673568

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:AjqeDDhfHHBfKqBRdQHVK1CUqo+yWwdxD1I:qDVntz0VK1CUqoFm

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:3235:EAQRBAAgBAKSABQhAABEASEAJgACAAIAgCYCAABACYIABAJQAEABRAAhAIEADAAAIGAQQAAAQKQIIgAhRAgkIAEpQgTAiAIA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:18183838180000ff
Perceptual Hash:c959b636e067a626
Difference Hash:b2f2f2f2b20d1080
Wavelet Hash:1c7c7c7cfc0000ff
Color Hash:010000001c0

Scan History

Scan history not available

Unable to load historical scan data