Security Scan: Secured Document

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/198c1d26-7edb-4a57-b861-7ca1a30ef8f7 Domain and IP registration (RDAP)/api/v1/rdap/198c1d26-7edb-4a57-b861-7ca1a30ef8f7How often this domain was scanned/api/v1/domain/stats/pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev Scan history for this domain/api/v1/domain/history/pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev?limit=15

This website contacted 11 IPs in 2 countries across 7 domains to perform 10 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev/sharepoint-e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3.html

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Fake 'Secured Document' / Cloud Storage sign-in on an anonymous R2 bucket whose inline script ships a Telegram bot token — a credential-harvesting page. Do not enter credentials.

Risk Factors (5)

Password-collecting form on an anonymous cloud-storage bucket (r2.dev) with unknown page age

Telegram bot token embedded in page script enabling covert delivery of captured input

Deceptive pretense of a secured/shareable document requiring sign-in

High-severity IDS alert for traffic to a *.tw domain plus three obfuscator-usage hunting alerts

Apostrophe-free typo 'Downlooad' and injected 'Sync error' string typical of phishing kits

Domain age information unavailable

Details

Page Title

Secured Document

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev' is registered; it also runs on subdomain 'pub-7b45cf3835c940eebae7c0a13a7ccb2a'. The registrable portion 'r2' spans 2 characters containing zero vowels alongside one consonant, plus one digit. Tokenizing the label suggests 2 words: r, 2. Median word length is 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.99s

Total Load Time

429 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:397 chars

Detector Agreement:100%

Website Classification

Primary Category

download file sharing98% confidence

Type: webapp

Method: ml+structural

All Detected Categories

download file sharing

98%

documentation technical

44%

technology software

43%

cryptocurrency blockchain

35%

social_media

25%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
10	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	104.18.40.68Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	23.216.77.58Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
0	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	104.16.78.6Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	34.200.162.253Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
0	142.251.13.95Google · CDN	United States	AS15169Google LLC
0	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	172.64.147.188Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	11	-	-