Security Scan Report: pub-658eb15335a243fa9b33e14e27558675.r2.dev

Site favicon
Submitted: Completed: publiccompleted
This website contacted 9 IPs in 2 countries across 6 domains to perform 13 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-658eb15335a243fa9b33e14e27558675.r2.dev/Roundcube%20Webmail.html

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Login page copying Roundcube Webmail branding, served from a shared Cloudflare R2 bucket rather than any webmail provider's domain. Classic credential-phishing shape; do not enter credentials.

Risk Factors (4)
Brand impersonation of Roundcube Webmail on unrelated cloud-storage domain
Password-collecting login form on shared Cloudflare R2 public bucket
Mismatched hosting domain vs. claimed webmail service, with unrelated external mail host referenced
Unknown real page age (platform apex age not attributable to this bucket)
Domain age information unavailable

Details

Page Title

Roundcube Webmail :: Welcome to Roundcube Webmail

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-658eb15335a243fa9b33e14e27558675.r2.dev' is registered, featuring subdomain 'pub-658eb15335a243fa9b33e14e27558675'. The second-level label 'r2' is 2 characters long containing 0 vowels alongside one consonant, along with 1 digit. Splitting it apart reveals 2 words: r, 2. The median word length lands at 1 character. No strong language cues emerged from the frequency lists.

Screenshot

& | [Lemail=|] @ | Password LOGIN Roundcube Webmail

Page Load Overview

1.81s
Total Load Time
241 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:115 chars
Detector Agreement:100%

Website Classification

Primary Category

cryptocurrency blockchain47% confidence
Type: webapp
Method: ml+structural

All Detected Categories

cryptocurrency blockchain
47%
news media journalism
44%
technology software
32%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
5104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
194.136.171.57United Kingdom
AS42831UK Dedicated Servers Limited
1142.250.154.95Google · CDNUnited States
AS15169Google LLC
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.16.179.112Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.16.180.112Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
139--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16212C8731E901D5213D356B77C17B6C4EC9F8C66BF20A4C6E5B258AC2E51E1DE2B2232

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:wYfcnWPHqhBQpRZlJGjLEk3ue349NprLoZKWKvHL7co4RYz:PfcnWPHqh6pRZlJGjAgue34/prLoZ3CB

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:9358:kiSEBGDeGTYeERIAACoIG4hUZAlm5QSxRWzATioCEiBABMAAFPryCFQIIsNMEBQT2ONwQAagMCVpCAjAvDIE/iMkAgBWoLUA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7e7e7ffffffff
Perceptual Hash:b333cccc64339999
Difference Hash:00080c0c00000000
Wavelet Hash:ffe7e7e700000000
Color Hash:N/A

Other Hashes

Crop Resistant:00080c0c00000000

Scan History

Scan history not available

Unable to load historical scan data