ScanMalware.com

Security Scan Report: pub-7a745ab32bd048868734c41c54237f6a.r2.dev

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/6c392b8d-b3ed-425b-af61-bb8a79925f8aDomain and IP registration (RDAP)/api/v1/rdap/6c392b8d-b3ed-425b-af61-bb8a79925f8aHow often this domain was scanned/api/v1/domain/stats/pub-7a745ab32bd048868734c41c54237f6a.r2.devScan history for this domain/api/v1/domain/history/pub-7a745ab32bd048868734c41c54237f6a.r2.dev?limit=15
This website contacted 2 IPs in 1 country across 1 domain to perform 1 HTTP transaction. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-7a745ab32bd048868734c41c54237f6a.r2.dev/documents_documents.html

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Fake DocuSign 'secure document portal' on a Cloudflare R2 bucket that impersonates DocuSign, gates access to Windows, and pushes the user to download and open a file — a malware-delivery lure, not a real document service.

Risk Factors (5)
Brand impersonation of DocuSign on a non-DocuSign, cloud-storage bucket domain
Instructs user to download and double-click an executable/PDF payload
OS gating and 'device not supported' screen consistent with evading automated analysis
Unranked domain with no attributable registration age (shared r2.dev tenant — age treated as unknown)
Misleading security assurances ('Secured by DocuSign', 'Windows trusted access only') to lower user guard
Domain age information unavailable

Details

Page Title

DocuSign - Secure Document Access

Scan Type

public

Domain Name Analysis

The domain 'pub-7a745ab32bd048868734c41c54237f6a.r2.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'pub-7a745ab32bd048868734c41c54237f6a'. The second-level label 'r2' is 2 characters long with 0 vowels and 1 consonant; it also includes one digit. It segments into two words: r, 2. Median word length is one character. No strong language cues emerged from the frequency lists.

Screenshot

a Secure Document Porial Encrypted document delivery & verification Windows Secure Enviranment iÎ Device Not Supported This secure portal is only accessible an Windows computers „Please open this...

Page Load Overview

0.32s
Total Load Time
15 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,015 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical50% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
50%
technology software
49%
government public service
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
12--

Detected Technologies2

Cloudflare Bot Management
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16662D82975B220357AB380EAB26A428F31138003F64B961DB9ED535C8FC2F9785763C7

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:VpwkT9o8cSAaol/DZ4NAF7AZ6kY4s0Gvf+lAHmkosQwTDqUTnUhh/0yFSak6GwOU:MkHcFV5KNAFkZ6kY4aX4iI9/HMDShDz

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:15701:cRwrAmKWc0BKhFpOUyXpSiNKqkBCsAwQAADEQZ2CQQgQDAKBT4AEiDCIigQOgqyAA1tQJCAhMGAZUA7DLucA3IClmaLu5ofO

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffffffe7e7ffff
Perceptual Hash:e65c597372486666
Difference Hash:0030282a4d0c3004
Wavelet Hash:00181818031b1b33
Color Hash:N/A

Other Hashes

Crop Resistant:0430282a4d283008,0000004040408000

Scan History

Scan history not available

Unable to load historical scan data