ScanMalware.com

Security Scan Report: pub-c53d218c4f704f2495ca7a15b052e24c.r2.dev

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/89d50141-c880-4e14-a8ae-f0259f9d0a46Domain and IP registration (RDAP)/api/v1/rdap/89d50141-c880-4e14-a8ae-f0259f9d0a46How often this domain was scanned/api/v1/domain/stats/pub-c53d218c4f704f2495ca7a15b052e24c.r2.devScan history for this domain/api/v1/domain/history/pub-c53d218c4f704f2495ca7a15b052e24c.r2.dev?limit=15
This website contacted 14 IPs in 3 countries across 9 domains to perform 10 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-c53d218c4f704f2495ca7a15b052e24c.r2.dev/monitor/monitor.html

AI Security Verdict

Confirmed Scam

Confidence: 95%

9
Risk Score

DocuSign-branded credential-harvesting page on a public Cloudflare R2 bucket, not a DocuSign domain. Password form plus fake authentication error text aimed at stealing logins.

Risk Factors (5)
Brand impersonation of DocuSign on a non-official domain
Credential (password) collection form on shared cloud-storage hosting
Fake authentication-required / error-code messaging designed to elicit password re-entry
Deceptive title presenting the bucket as the DocuSign login portal
Unknown page age behind a shared r2.dev namespace; no legitimate business presence
Domain age information unavailable

Details

Page Title

DocuSign Login - Enter your password to sign in

Scan Type

public

Domain Name Analysis

The domain 'pub-c53d218c4f704f2495ca7a15b052e24c.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-c53d218c4f704f2495ca7a15b052e24c'. The second-level label 'r2' is 2 characters long split between 0 vowels and one consonant, plus one digit. Segmentation suggests 2 words: r, 2. Median word length is one character. No strong language cues emerged from the frequency lists.

Screenshot

DocuSign DocuSign i\ You are required to complete an authentication in order to proceed! kindly confirm action by choosing below. DocuSign Login with DocuSign Login with my email This authentica...

Page Load Overview

1.01s
Total Load Time
512 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:557 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical35% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical
35%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0141.193.213.21Cloudflare · CDNUnited States
AS209242Cloudflare London, LLC
0185.111.111.154Frankfurt am Main, Hesse, Germany
AS212238Datacamp Limited
0104.18.43.144Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0187.127.201.248Kuala Lumpur, Kuala Lumpur, Malaysia
AS47583Hostinger International Limited
0172.64.147.160Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0142.251.13.95Google · CDNUnited States
AS15169Google LLC
0104.18.36.77Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0170.114.78.89Cloudflare · CDNUnited States
AS209242Cloudflare London, LLC
1014--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BB448B3249239C2708DED5C7591D6FDA7FA4CDCB46316223B07C818CA791AF22D9A25F

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:gajpSYt72uB8zd3nuatHiuZ1aYxs7TA7VmserIxzFJkzFuOtHXf5n:ga1SYtRc33CMaoQTA7Vmserr

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:256324:uIABvCACBQQRDSgEZBQcxIKYwQB1GBSCA0iKwggLBGBrSYJAkQAqiQEpMQZElFobDgIAxkgLJnAwCnwFBQhMIhqQAEwIGiAE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7fffe7efe3ffffef
Perceptual Hash:b38f8c253399c666
Difference Hash:883228484d20308c
Wavelet Hash:7f3c3424243c3cee
Color Hash:070000001c0

Other Hashes

Crop Resistant:883228484d20308c

Scan History

Scan history not available

Unable to load historical scan data