ScanMalware.com

Security Scan Report: pub-2cd796e07737407a9447e3735195d740.r2.dev

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3fc78105-8d7b-40ad-9530-8a2e531db8ffDomain and IP registration (RDAP)/api/v1/rdap/3fc78105-8d7b-40ad-9530-8a2e531db8ffHow often this domain was scanned/api/v1/domain/stats/pub-2cd796e07737407a9447e3735195d740.r2.devScan history for this domain/api/v1/domain/history/pub-2cd796e07737407a9447e3735195d740.r2.dev?limit=15
This website contacted 11 IPs in 2 countries across 6 domains to perform 14 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-2cd796e07737407a9447e3735195d740.r2.dev/xxxwebxxx.html

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Fake cPanel/Webmail login hosted on a Cloudflare R2 bucket that harvests email passwords and POSTs them to synapseconsultoria.com.br; confirmed by two HIGH phishing IDS alerts.

Risk Factors (5)
Credential-harvesting login form on a cloud-storage bucket tenant
Cross-origin credential POST to an unrelated external domain
Two ET PHISHING HIGH IDS alerts (generic phishing landing, multibrand AJAX credential POST landing)
Impersonation of the cPanel/Webmail login interface on a non-official domain
Unranked domain with no legitimacy indicators
Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

The domain name 'pub-2cd796e07737407a9447e3735195d740.r2.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-2cd796e07737407a9447e3735195d740'. The second-level label 'r2' is 2 characters long with 0 vowels and one consonant, notching one digit. Splitting it apart reveals two words: r, 2. Median word length comes out to one character. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://pub-2cd796e07737407a9447e3735195d740.r2.dev/xxxwebxxx.html

Page Load Overview

1.79s
Total Load Time
205 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,384 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software29% confidence
Type: webapp
Method: ml+structural

All Detected Categories

technology software
29%
social_media
25%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1184.154.215.138United States
AS32475Internap Holding LLC
1151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
12.16.10.139Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
1104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1151.101.193.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.10.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1411--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12EB2A501A8EA14A3005260DC7EBA151D2E96D317890F8E04B17E5BE95FD7F8EFC9B189

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:WinWD/ZmXg8gsy+lClNEvWXPOv2yHipbxzsFvf:NWTZmXg84lNEvWXPOv2Zun

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:25391:MgkQZCIBpC1jEwWjIlRTmEoOFEwCgAfCOJSJJFYAZQDfQIbyIpPDDOwMAIQQk5EDBFABqkBQBGSYKMhUClhasiYCQwWAhjEF

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7f7f7f7fffffffff
Perceptual Hash:8000d8ffff0301ff
Difference Hash:8080c08800000000
Wavelet Hash:7c7c7c6400000000
Color Hash:#87c5a9

Other Hashes

Crop Resistant:8080c08800000000

Scan History

Scan history not available

Unable to load historical scan data