Security Scan: https://pub-6a24d11994f74a3199b5ae0da5f56237.

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/41c074ec-d6db-4605-9c22-7ad73be04e16 Domain and IP registration (RDAP)/api/v1/rdap/41c074ec-d6db-4605-9c22-7ad73be04e16How often this domain was scanned/api/v1/domain/stats/pub-6a24d11994f74a3199b5ae0da5f56237.r2.dev Scan history for this domain/api/v1/domain/history/pub-6a24d11994f74a3199b5ae0da5f56237.r2.dev?limit=15

This website contacted 1 IP in 1 country across 2 domains to perform 3 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-6a24d11994f74a3199b5ae0da5f56237.r2.dev/makana.html

AI Security Verdict

High Risk

Confidence: 88%

Risk Score

Turnstile-lookalike gate page on an R2 public bucket, matching an analyst-vetted 'Turnstile gate kit' loader (YARA Turnstile_Gate_Kit_ScPhp_Loader) that hides a base64 next-stage URL pointing to goodingtitle.cam. Avoid; the redirect target is the likely phishing stage.

Risk Factors (5)

Known malicious kit identification (Turnstile gate loader) flagged HIGH phishing in the vetted kit roster

High-precision YARA rule match for hidden base64 next-stage URL redirection

Fake Turnstile/verification interstitial pattern used as a deflection gate in front of a phishing next stage on goodingtitle.cam

Hosted on an anonymous public object-storage bucket rather than a real brand domain

No indexable page content — the page exists only to run its loader logic

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-6a24d11994f74a3199b5ae0da5f56237.r2.dev' is registered with subdomain 'pub-6a24d11994f74a3199b5ae0da5f56237'. Count 2 characters in 'r2' holding 0 vowels versus 1 consonant, plus one digit. Segmentation suggests 2 words: r, 2. Average segment length settles at 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.57s

Total Load Time

27 KB

Total Size

Language Analysis

Primary Language

🏳️UNKNOWN

Code: unknown

Confidence:0%

Detection Details

Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	1	-	-

Detected Technologies2

Cloudflare Bot Management

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T191D0A7F3ABA4F5302F4069E825B2911D012BA1487E408C4449841A384805A5E4A115A4

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6:qzxO966qerpqqelj5pje73BxsY9AfLve2NwiqOXANbBoOI:kxPrerpelj5U73Bxs8AfLrpqOXMI

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:1:0:491b34eb8761fb5150b2e83b3dcca80d

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:N/A

Perceptual Hash:N/A

Difference Hash:N/A

Wavelet Hash:N/A

Color Hash:N/A

Other Hashes

Crop Resistant:N/A

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: pub-6a24d11994f74a3199b5ae0da5f56237.r2.dev