Security Scan: Webmail Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/5b080b4c-2511-48d6-94e6-9d23c47c8ad0 Domain and IP registration (RDAP)/api/v1/rdap/5b080b4c-2511-48d6-94e6-9d23c47c8ad0How often this domain was scanned/api/v1/domain/stats/pub-1bae389293eb48d58e53398a6e375d75.r2.dev Scan history for this domain/api/v1/domain/history/pub-1bae389293eb48d58e53398a6e375d75.r2.dev?limit=15

This website contacted 10 IPs in 2 countries across 7 domains to perform 21 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-1bae389293eb48d58e53398a6e375d75.r2.dev/xulopa.html

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Fake cPanel webmail login on a public R2 bucket that posts entered email and password to tompk.cam — a textbook credential-phishing kit. Do not enter credentials.

Risk Factors (4)

Credential-harvesting login form (email + password) on shared cloud storage rather than a mail provider domain

Cross-origin POST of form data to tompk.cam, unrelated to the hosting domain

Impersonation of cPanel webmail branding and copyright notice

Unknown content age hidden behind a shared-hosting platform apex

Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-1bae389293eb48d58e53398a6e375d75.r2.dev' is registered and includes subdomain 'pub-1bae389293eb48d58e53398a6e375d75'. The second-level label 'r2' is 2 characters long split between zero vowels and one consonant, notching 1 digit. It segments into 2 words: r, 2. Median word length is one character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.06s

Total Load Time

280 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:218 chars

Detector Agreement:100%

Website Classification

Primary Category

finance banking57% confidence

Type: webapp

Method: ml+structural+ocr_tiebreaker

All Detected Categories

finance banking

57%

technology software

41%

corporate business

38%

government public service

35%

documentation technical

28%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	162.241.27.10	Mumbai, Maharashtra, India	AS46606Unified Layer
2	151.101.1.155Fastly · CDN	United States	AS54113Fastly, Inc.
2	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.127.95Google · CDN	United States	AS15169Google LLC
2	104.18.10.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	151.101.65.155Fastly · CDN	United States	AS54113Fastly, Inc.
2	104.17.25.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
21	10	-	-