ScanMalware.com

Security Scan Report: pub-c94901a072aa467bab48aec9868ed584.r2.dev

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3c5df3e2-3b5a-43d3-8718-4af806d3714bDomain and IP registration (RDAP)/api/v1/rdap/3c5df3e2-3b5a-43d3-8718-4af806d3714bHow often this domain was scanned/api/v1/domain/stats/pub-c94901a072aa467bab48aec9868ed584.r2.devScan history for this domain/api/v1/domain/history/pub-c94901a072aa467bab48aec9868ed584.r2.dev?limit=15
This website contacted 3 IPs in 1 country across 4 domains to perform 6 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-c94901a072aa467bab48aec9868ed584.r2.dev/tomhardy/index.html

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Fake 'view document' login page on a Cloudflare R2 bucket that posts the typed email and password to an unrelated external server (iboymegapanel.com). Two HIGH phishing IDS signatures confirm credential harvesting.

Risk Factors (4)
Cross-origin exfiltration of email and password to iboymegapanel.com
HIGH-severity phishing IDS signatures matching a known ajax credential-POST landing kit
Credential harvesting form disguised as a document-access gate on free cloud storage
No legitimate service identity or branding; anonymous shared-hosting bucket path
Domain age information unavailable

Details

Page Title

Signin to continue

Scan Type

public

Domain Name Analysis

Domain 'pub-c94901a072aa467bab48aec9868ed584.r2.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'pub-c94901a072aa467bab48aec9868ed584'. Count 2 characters in 'r2' holding 0 vowels versus 1 consonant, notching 1 digit. Segmentation suggests 2 words: r, 2. Median word length comes out to one character. No strong language cues emerged from the frequency lists.

Screenshot

Sign in with your Email Credentials to view the document Email Address ‘Must be a valid email address. Password Your password must be at least 6 characters as well as contain at least one uppercase...

Page Load Overview

0.59s
Total Load Time
52 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:57%
Script:Latin
Direction:ltr

Detection Details

Text Length:332 chars
Detector Agreement:100%

Website Classification

Primary Category

news media journalism45% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

news media journalism
45%
adult content
44%
documentation technical
44%
government public service
41%
healthcare medical
36%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2142.251.14.95Google · CDNUnited States
AS15169Google LLC
2104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
63--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13FE18749A4E33492253360B83B7FA6043AF4840F0D0CCD44B5AC7A84AF58F97BD671C9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:I0sLzQ4d9PZQeiVK8seeBU4uIxeCSBrFr:I0sLb6eUNV

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:7233:YARIihAUCKiQLA5DADaYQCoQAkMALtDgAJiKCBQBAImrBnCsICaSkdJFNAxeoBBdkyAgYCAAqMAIsRQgDBBQAnEKhFIgAABE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3f0fffffffffffff
Perceptual Hash:80000001e7ffffff
Difference Hash:c0f0000000000000
Wavelet Hash:3000f0f0f0f0f0f0
Color Hash:N/A

Other Hashes

Crop Resistant:c0f0000000000000

Scan History

Scan history not available

Unable to load historical scan data