Security Scan Report: pub-88cf6dcaaf644a2983ecd06ed34d2054.r2.dev

Submitted: Completed: publiccompleted
This website contacted 6 IPs in 1 country across 3 domains to perform 5 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-88cf6dcaaf644a2983ecd06ed34d2054.r2.dev/FMfcgzGxStxRcnxPZCJrKLbLkHQThtdK.html

AI Security Verdict

High Risk

Confidence: 76%

8
Risk Score

Disposable Cloudflare R2 document showing only a 'Verifying site connection...' cloaking gate and reaching an external KPMG-lookalike domain (kpmg-mx.com). No forms on this stage, but the impersonation and scanner evasion make it unsafe.

Risk Factors (5)
Cloaking/verification interstitial ('Verifying site connection...') used to defeat automated inspection
Random-named HTML document on a disposable public R2 bucket URL
Association with a KPMG-impersonating domain (kpmg-mx.com) reached from the gated page
No legitimate site identity: no title, no branding of its own, no verifiable content
Noindex absent but zero real content rendered to scanners — content is held behind JS/verification
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-88cf6dcaaf644a2983ecd06ed34d2054.r2.dev' is registered, featuring subdomain 'pub-88cf6dcaaf644a2983ecd06ed34d2054'. The registrable portion 'r2' spans 2 characters split between 0 vowels and one consonant, notching one digit. Word splitting yields 2 words: r, 2. The median word length lands at 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://pub-88cf6dcaaf644a2983ecd06ed34d2054.r2.dev/FMfcgzGxStxRcnxPZCJrKLbLkHQThtdK.html

Page Load Overview

0.87s
Total Load Time
59 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:74%
Script:Latin
Direction:ltr

Detection Details

Text Length:28 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
5104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0172.232.24.161Chicago, Illinois, United States
AS63949Akamai Connected Cloud
0104.18.94.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0172.234.25.42Chicago, Illinois, United States
AS63949Akamai Connected Cloud
0104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
56--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1750194D2E2298C104DC356F027A0D30C4666C158EB8F89412ED6022FD48B7DC8F606DC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12:kx2REXy7iLHskwGWLyPvKNGexV/mgKpOo7DzBkCuoerpeClhc5koA7T3uCgOXLiU:kcACMWLyXKVV/qhFuJkaK5koA7CyuG

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:711:AAAAAAAAAAAAAAgACAAgAAAAAAAAAgAAIAAAAIAAAAAAACAAABAAAAIAAAAAAAAAAAJAIIIAAAAAAAAAAAAAIAAAAAAAQAAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe7e7ffffff
Perceptual Hash:b323cccc3333cccc
Difference Hash:0000000808000000
Wavelet Hash:f0f0d8c0e4fcf0f0
Color Hash:#741f93

Other Hashes

Crop Resistant:0000000808000000

Scan History

Scan history not available

Unable to load historical scan data