ScanMalware.com

Security Scan Report: pub-dfa5dc9b1b264e89b08343cf0a26450b.r2.dev

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/247a8cf0-a2dd-43cb-9d12-0b14c98b0df3Domain and IP registration (RDAP)/api/v1/rdap/247a8cf0-a2dd-43cb-9d12-0b14c98b0df3How often this domain was scanned/api/v1/domain/stats/pub-dfa5dc9b1b264e89b08343cf0a26450b.r2.devScan history for this domain/api/v1/domain/history/pub-dfa5dc9b1b264e89b08343cf0a26450b.r2.dev?limit=15
This website contacted 2 IPs in 1 country across 2 domains to perform 4 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-dfa5dc9b1b264e89b08343cf0a26450b.r2.dev/mod.shtml#aWZ1Y2tlZEB5b3VybW9tLmNvbQ==

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Outlook-branded credential phishing kit on a public R2 bucket; URL carries a base64 victim-email token and the page collects a password. Do not enter credentials.

Risk Factors (6)
Base64-encoded email in URL with domain mismatch to the hosting domain
Password + username form on shared cloud storage hosting
Impersonation of a mail provider brand on an unrelated r2.dev subdomain
Typosquatted third-party script host code.jquery.com.de referenced
Obfuscated JavaScript heuristics flagged by IDS
Domain unranked and hosted on an instant-publish bucket namespace
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain name 'pub-dfa5dc9b1b264e89b08343cf0a26450b.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-dfa5dc9b1b264e89b08343cf0a26450b'. Its registrable label 'r2' stretches across 2 characters containing zero vowels alongside one consonant, along with one digit. It segments into 2 words: r, 2. Average segment length settles at 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Giz Outlook

Page Load Overview

0.70s
Total Load Time
227 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
0
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
42--

Detected Technologies2

JQueryv3.5.1
100%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1E084BE782F03F81C8B0789BEF9663A42F2544D47B65499D8790C0E87EF68B189DF6835

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:K8+GSrvlxsFrCa7HoKbXLVXW0H5bHugUH7m0B5QUHob2pVuQwIpB5yB5XB57B55b:K8/SziwiMwjXjP0A8/SziEiMwjXa

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:399431:AAEoZqDjITIQBBISsNx5IGwBEcqlyBghRlAUMCDRgIgtGgAYFUIBACEIEhADQSSIB6BkoNoDUQKScMhIxwNsoggoPGgR4TXe

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3f3f3f3f3f3f3f3f
Perceptual Hash:83770989fcf62703
Difference Hash:d8d0ccccd8d0d0d0
Wavelet Hash:30300000030b3f3f
Color Hash:060000001c0

Other Hashes

Crop Resistant:90a09c9890808080,e384acb6b6ac84f3,00080671710e2000

Scan History

Scan history not available

Unable to load historical scan data