English

The domain 'pub-67d4c17ca5cc456cbb7eec6c156c7e97.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-67d4c17ca5cc456cbb7eec6c156c7e97'. Its registrable label 'r2' stretches across 2 characters containing 0 vowels alongside 1 consonant, plus 1 digit. Tokenizing the label suggests two words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

html/70/fb/70fbfa22-913d-4c3a-9094-cf3cff810a78.html.gz

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Regex in its jQuery.htmlPrefilter sometimes may introduce XSS

f375b5a8e8766ff88c1e8fabef7d66b0727aaf289bd090315dc300ba9a304be6

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

Abuse Team

CloudFlare, Inc.

r2.dev

Abuse

Google LLC

GOOGLE

JQuery

Cloudflare Bot Management

Cloudflare

jQuery CDN

MetaMask

☠️ Malicious - https://pub-67d4c17ca5cc456cbb7eec6c156c7e97.r2.dev/index.html

Requests	IP Address	Location	AS Autonomous System
6	142.251.20.94Google · CDN	United States	AS15169Google LLC
1	151.101.129.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	151.101.65.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	172.217.208.95Google · CDN	United States	AS15169Google LLC
1	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
11	6	-	-

Security Scan Report: pub-67d4c17ca5cc456cbb7eec6c156c7e97.r2.dev

Summary

AI Security Verdict

High Risk

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History