Security Scan Report: pub-8cdf3294ae6b41b29a9cda26deed6232.r2.dev

Submitted: Oct 7, 2026, 6:53:35 AMCompleted: Oct 7, 2026, 6:54:09 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Google Safe Browsing flags Social Engineering and the page is a credential-harvesting login ('sign in to your email account to download the file') on a Cloudflare R2 public bucket — phishing, do not enter credentials.

Risk Factors (5)
Google Safe Browsing Social Engineering threat (2 instances)
Login form collecting email + password on cloud-storage/public-bucket hosting
Credential-harvesting lure tied to a promised file download (exel.html)
Live 'Invalid Password' error text confirming interactive credential capture
Unranked domain (not in Cisco Umbrella top 1M) on instant-publish namespace r2.dev; age not attributable to the page
Domain age information unavailable

Details

Page Title

Sign In

Scan Type

public

Domain Name Analysis

Domain 'pub-8cdf3294ae6b41b29a9cda26deed6232.r2.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'pub-8cdf3294ae6b41b29a9cda26deed6232'. The core label 'r2' covers 2 characters with 0 vowels and one consonant; it also includes 1 digit. Segmentation suggests two words: r, 2. The median word length lands at one character. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://pub-8cdf3294ae6b41b29a9cda26deed6232.r2.dev/exel.html

Page Load Overview

0.62s
Total Load Time
170 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:196 chars
Detector Agreement:100%

Website Classification

Primary Category

download file sharing65% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

download file sharing
65%
news media journalism
34%
technology software
32%
healthcare medical
31%
documentation technical
29%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
6104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.10.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1151.101.129.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1142.251.14.95Google · CDNUnited States
AS15169Google LLC
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1151.101.193.155Fastly · CDNUnited States
AS54113Fastly, Inc.
127--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1DB330F2C3C288CEBE0113577AB1575B8AB207D96E981454DF36C6DB0A7927FBBD210B1

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:1D7By9476DV13w8SOZieAOlXPLItqPGe7MdbPsRovdBdaBL:d094qtSvdBd6L

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:54982:FcVIBYiCkpj0KBAoBCCIDF4M4kZgEVMRAQGUGAAQgFwBkYDkQYiQMiPCZAOtyHMSSNiMTBgwsCCAkXcQBSUISUEkQAhCVgh4

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:efff2e7effffffff
Perceptual Hash:9505aafaf55503aa
Difference Hash:0800c88000000000
Wavelet Hash:e4e4257cf0f0f0f0
Color Hash:#8c40bf

Other Hashes

Crop Resistant:0800c88000000000

Scan History

Scan history not available

Unable to load historical scan data