Security Scan: Webmail Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/49cb2cd8-9c85-4321-b269-9f1dd4d3c90e Domain and IP registration (RDAP)/api/v1/rdap/49cb2cd8-9c85-4321-b269-9f1dd4d3c90e Certificate Transparency/api/v1/ct/pub-37e0821b39ef4ddd869a063490f0f064.r2.dev How often this domain was scanned/api/v1/domain/stats/pub-37e0821b39ef4ddd869a063490f0f064.r2.dev Scan history for this domain/api/v1/domain/history/pub-37e0821b39ef4ddd869a063490f0f064.r2.dev?limit=15

This website contacted 9 IPs in 2 countries across 7 domains to perform 18 HTTP transactions. The main domain is pub-37e0821b39ef4ddd869a063490f0f064.r2.dev and was registered 14 years ago.

Submitted URL: https://pub-37e0821b39ef4ddd869a063490f0f064.r2.dev/webmailwebsitw.html#[email protected]

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Fake cPanel Webmail login on a Cloudflare R2 bucket that harvests email credentials and exfiltrates them to kclog.e6f.online; a HIGH-severity phishing IDS alert and a victim email token in the URL confirm a live phishing kit.

Risk Factors (7)

Credential (email + password) capture form on cloud-storage host

Credential exfiltration POST to external domain kclog.e6f.online

Email address embedded in URL fragment as victim tracking token

Network IDS HIGH-severity phishing alert (ET PHISHING CredPost landing)

JavaScript blocks right-click / context menu (anti-analysis)

Impersonates cPanel Webmail login on a non-owner domain

Hosting platform apex age is not attributable to this page (unknown page age; unranked domain)

Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

You're looking at domain 'pub-37e0821b39ef4ddd869a063490f0f064.r2.dev' on the developer-focused generic top-level domain (.dev) and includes subdomain 'pub-37e0821b39ef4ddd869a063490f0f064'. Its registrable label 'r2' stretches across 2 characters split between zero vowels and 1 consonant; bonus characters include one digit. Segmentation suggests two words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.67s

Total Load Time

244 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:1,438 chars

Detector Agreement:100%

Website Classification

Primary Category

social_media50% confidence

Type: webapp

Method: structural

All Detected Categories

social_media

50%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	162.241.27.10	Mumbai, Maharashtra, India	AS46606Unified Layer
2	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
2	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.14.95Google · CDN	United States	AS15169Google LLC
2	104.18.10.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	151.101.129.155Fastly · CDN	United States	AS54113Fastly, Inc.
2	142.251.127.95Google · CDN	United States	AS15169Google LLC
18	9	-	-