Security Scan Report: pub-e5748588f20f4fcc9a07ee3482f44c67.r2.dev

Submitted: Completed: publiccompleted
This website contacted 13 IPs in 1 country across 8 domains to perform 12 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-e5748588f20f4fcc9a07ee3482f44c67.r2.dev/59e1b1a120e40bf6e388a325ccb3c1a8.html

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Anonymous R2 bucket serving an unrendered credential-expiry phishing template with heavily obfuscated JavaScript; no credential form on this page, but the kit shape and flagged hosts make it unsafe.

Risk Factors (5)
Unrendered phishing template with unresolved merge fields ([EMail], [Date_long], [Time_short]) and mail-merge function calls visible in page text
Fake credential-expiry / 'same password access' lure
Obfuscated inline JavaScript with eval() and 5 HIGH IDS hex-obfuscation alerts
Hosted on an anonymous Cloudflare R2 public bucket with no legitimate brand ownership
Primary domain and a loaded third-party host both appear on a malicious-host threat-intel feed (single-source, unverified)
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

You're looking at domain 'pub-e5748588f20f4fcc9a07ee3482f44c67.r2.dev' on the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-e5748588f20f4fcc9a07ee3482f44c67'. Count 2 characters in 'r2' containing 0 vowels alongside 1 consonant, notching 1 digit. Tokenizing the label suggests 2 words: r, 2. The median word length lands at one character. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://pub-e5748588f20f4fcc9a07ee3482f44c67.r2.dev/59e1b1a120e40bf6e388a325ccb3c1a8.html

Page Load Overview

1.91s
Total Load Time
283 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,187 chars
Detector Agreement:100%

All Detected Languages

🇺🇸en(54%)🇫🇷fr(39%)🇵🇹pt(7%)

Website Classification

Primary Category

social media network89% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

social media network
89%
government public service
31%
real estate property
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.20.95Google · CDNUnited States
AS15169Google LLC
1142.251.14.95Google · CDNUnited States
AS15169Google LLC
1104.21.27.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0151.101.193.155Fastly · CDNUnited States
AS54113Fastly, Inc.
00.0.0.1United StatesUnknown
0104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0142.251.110.95Google · CDNUnited States
AS15169Google LLC
1213--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C4E2EFF461004A9A943E4C9FF34E9BC4220B3B57B782CD2836ED055A9BDCE5513973BA

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:YPzEoJeB0f/4la3EK5q3+reh398hWHdjdf9xDHacphtJDJVBDtwYDQbDD36uX7Le:OEi/kK5qOAFx1x9ntJDbJwLNLsLjLhSa

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:33627:JAQssGyIoASASaBQoGAEILbIAAR4CscAJQObE8kAAQIAGMZCASm0hqZwI8JAIGAQQ4cAnDQJ50AACsBaEETRMJPgKUBBKABs

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:feffffffffffffff
Perceptual Hash:d555555555555554
Difference Hash:0000000000000000
Wavelet Hash:0e0e0e0e0e0e0e0e
Color Hash:07000000000

Other Hashes

Crop Resistant:0000000000000000

Scan History

Scan history not available

Unable to load historical scan data