Security Scan: Webmail Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/7c2138cc-18db-4735-a56c-5c64eec12328 Domain and IP registration (RDAP)/api/v1/rdap/7c2138cc-18db-4735-a56c-5c64eec12328How often this domain was scanned/api/v1/domain/stats/pub-af5d7935fe154626a7cf01e7f0f34be2.r2.dev Scan history for this domain/api/v1/domain/history/pub-af5d7935fe154626a7cf01e7f0f34be2.r2.dev?limit=15

This website contacted 6 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-af5d7935fe154626a7cf01e7f0f34be2.r2.dev/roundcube.html

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

Fake webmail login served from a Cloudflare R2 bucket, mimicking cPanel/Roundcube with a password field to harvest email credentials. Do not enter credentials.

Risk Factors (4)

Credential-harvesting login form on shared cloud storage with no legitimate operator identity

Impersonation of a webmail service (cPanel/Roundcube styling and copyright) on a non-official domain

Hidden form fields and JavaScript-only submit path consistent with a phishing kit

No ownership, brand, or contacting details tying the bucket to any real webmail provider

Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

The domain 'pub-af5d7935fe154626a7cf01e7f0f34be2.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-af5d7935fe154626a7cf01e7f0f34be2'. The core label 'r2' covers 2 characters containing 0 vowels alongside 1 consonant, plus one digit. It segments into two words: r, 2. Median word length is one character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

75.26s

Total Load Time

197 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:1,043 chars

Detector Agreement:100%

Website Classification

Primary Category

adult content53% confidence

Type: dynamic

Method: ml+structural+ocr_tiebreaker

All Detected Categories

adult content

53%

government public service

44%

technology software

38%

corporate business

31%

finance banking

26%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	190.183.195.2	Santo Tomé, Santa Fe, Argentina	AS20207Gigared S.A.
2	5.101.109.44	Frankfurt am Main, Hesse, Germany	AS14061DigitalOcean, LLC
2	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
2	151.101.129.155Fastly · CDN	United States	AS54113Fastly, Inc.
17	6	-	-