Security Scan: Sign in to your account

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/74a10277-79a2-4e7f-b7f4-b0258950c1e8 Domain and IP registration (RDAP)/api/v1/rdap/74a10277-79a2-4e7f-b7f4-b0258950c1e8How often this domain was scanned/api/v1/domain/stats/pub-8198ef94712a43e5a05e0ea8720214fd.r2.dev Scan history for this domain/api/v1/domain/history/pub-8198ef94712a43e5a05e0ea8720214fd.r2.dev?limit=15

This website contacted 2 IPs in 1 country across 2 domains to perform 3 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-8198ef94712a43e5a05e0ea8720214fd.r2.dev/oblivionauth%5D.html

AI Security Verdict

High Risk

Confidence: 84%

Risk Score

Microsoft sign-in page cloned on a Cloudflare R2 public bucket, collecting password and MFA code with a 'sensitive document' pretext — brand impersonation plus credential capture; do not enter credentials.

Risk Factors (5)

Impersonation of Microsoft's sign-in experience on a non-Microsoft cloud-storage bucket

Credential and MFA-code collection fields (password + one-time code) on a shared R2 public bucket

Hidden password field in DOM not shown to the user

Urgency/sensitive-document pretext used to justify re-entering a password

Copied Microsoft sign-in error strings ('server_error:The contextID supplied in the request did not have a matching cookie') indicating a cloned page

Domain age information unavailable

Details

Page Title

Scan Type

public

Domain Name Analysis

You're looking at domain 'pub-8198ef94712a43e5a05e0ea8720214fd.r2.dev' on the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-8198ef94712a43e5a05e0ea8720214fd'. The registrable portion 'r2' spans 2 characters containing zero vowels alongside one consonant, plus 1 digit. It segments into two words: r, 2. Average segment length settles at one character. No strong language cues emerged from the frequency lists.