Security Report: pub-4e49405fbe2144e9a804826dae9ed060.r2.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/1e8b68fc-a2ea-4a0f-819d-e4f45af3add0 Domain and IP registration (RDAP)/api/v1/rdap/1e8b68fc-a2ea-4a0f-819d-e4f45af3add0 Certificate Transparency/api/v1/ct/pub-4e49405fbe2144e9a804826dae9ed060.r2.dev How often this domain was scanned/api/v1/domain/stats/pub-4e49405fbe2144e9a804826dae9ed060.r2.dev Scan history for this domain/api/v1/domain/history/pub-4e49405fbe2144e9a804826dae9ed060.r2.dev?limit=15

This website contacted 4 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main domain is pub-4e49405fbe2144e9a804826dae9ed060.r2.dev and was registered 15 years ago.

Submitted URL: https://pub-4e49405fbe2144e9a804826dae9ed060.r2.dev/index.htm

AI Security Verdict

Confirmed Scam

Confidence: 84%

Risk Score

Cloned webmail login on an anonymous Cloudflare R2 bucket, collecting username/password with Roundcube-style fields and referencing webmail.earth-core.jp. No legitimate site identity — treat as a credential-phishing page.

Risk Factors (5)

Credential login form with a password field published on shared cloud-storage hosting (Cloudflare R2 public bucket)

Page imitates a webmail service while being hosted on an untouched, unranked third-party bucket namespace

Hidden webmail template fields (_token/_task/_action/_url) indicating a harvested/cloned mail login page

External reference to webmail.earth-core.jp from the phishing page

No site identity, no terms/about, no legitimate reason for a mail login to live on an R2 bucket

Domain age information unavailable

Details

Page Title

:: Welcome to Webmail

Scan Type

public

Favicon Hash

MMH3: -2140379067

MD5: 228ba3f6d946af4298b080e5c934487c

Domain Name Analysis

Domain 'pub-4e49405fbe2144e9a804826dae9ed060.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-4e49405fbe2144e9a804826dae9ed060'. The registrable portion 'r2' spans 2 characters with zero vowels and one consonant; it also includes 1 digit. Segmentation suggests two words: r, 2. Median word length comes out to one character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

5.13s

Total Load Time

125 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:44%

Script:Latin

Direction:ltr

Detection Details

Text Length:276 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical64% confidence

Type: webapp

Method: ml+structural

All Detected Categories

documentation technical

64%

technology software

61%

adult content

50%

news media journalism

50%

government public service

47%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	219.118.67.12	Japan	AS2514NTT PC Communications, Inc.
3	151.101.129.155Fastly · CDN	United States	AS54113Fastly, Inc.
3	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
12	4	-	-