Security Report: pub-8e63259eff0b4937a0774c5beb36fae6.r2.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/7cf732e8-c901-4c7e-9db7-fd6ee7504ffd Domain and IP registration (RDAP)/api/v1/rdap/7cf732e8-c901-4c7e-9db7-fd6ee7504ffdHow often this domain was scanned/api/v1/domain/stats/pub-8e63259eff0b4937a0774c5beb36fae6.r2.dev Scan history for this domain/api/v1/domain/history/pub-8e63259eff0b4937a0774c5beb36fae6.r2.dev?limit=15

This website contacted 3 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-8e63259eff0b4937a0774c5beb36fae6.r2.dev/mistamandy71upda.html

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Cloned Roundcube Webmail login on an anonymous R2 bucket that submits captured usernames and passwords to jfisb.com; three HIGH phishing IDS signatures confirm credential phishing.

Risk Factors (5)

Brand impersonation of Roundcube Webmail on an unrelated cloud-storage subdomain

Password/credential harvesting form on shared cloud storage with cross-origin POST exfiltration to jfisb.com

Multiple HIGH-severity network IDS phishing landing page signatures

Hidden _token/_task/_action fields mimicking a genuine Roundcube login flow to appear authentic

Hosted on an anonymous public R2 bucket; page age unknowable and apex age not attributable

Domain age information unavailable

Details

Page Title

Roundcube Webmail :: Welcome to Roundcube Webmail

Scan Type

public

Favicon Hash

MMH3: -1754690812

MD5: 924a68d347c80d0e502157e83812bb23

Domain Name Analysis

Domain 'pub-8e63259eff0b4937a0774c5beb36fae6.r2.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-8e63259eff0b4937a0774c5beb36fae6'. Count 2 characters in 'r2' containing zero vowels alongside 1 consonant, plus 1 digit. Splitting it apart reveals 2 words: r, 2. Median word length comes out to 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.41s

Total Load Time

317 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:293 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software45% confidence

Type: webapp

Method: ml+structural

All Detected Categories

technology software

45%

documentation technical

43%

phishing scam

43%

adult content

37%

news media journalism

33%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	94.136.171.57	United Kingdom	AS42831UK Dedicated Servers Limited
17	3	-	-