Security Scan: https://pub-da0890dd4543473aa8e84f5a3c6e45bb.

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a372d37b-388f-4d36-9482-f353f2139d5c Domain and IP registration (RDAP)/api/v1/rdap/a372d37b-388f-4d36-9482-f353f2139d5cHow often this domain was scanned/api/v1/domain/stats/pub-da0890dd4543473aa8e84f5a3c6e45bb.r2.dev Scan history for this domain/api/v1/domain/history/pub-da0890dd4543473aa8e84f5a3c6e45bb.r2.dev?limit=15

This website contacted 6 IPs in 1 country across 3 domains to perform 5 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-da0890dd4543473aa8e84f5a3c6e45bb.r2.dev/campaignsN4Ig9gTgJgphBCBPEAuEEYA.html

AI Security Verdict

High Risk

Confidence: 90%

Risk Score

Anonymous R2 bucket serving a known Turnstile-gate phishing kit ('Verifying site connection...') with a hidden base64 next-stage URL. Analyst-vetted kit match plus high-precision hunting-rule hit — avoid and report.

Risk Factors (5)

Known malicious Turnstile-gate phishing kit identified by analyst-vetted roster

High-precision hunting rule match for the sc.php loader with hidden base64 next-stage URL

Decoy 'Verifying site connection...' interstitial with no underlying content

Hosted on anonymous object storage (public R2 bucket) used as throwaway infrastructure

Loader pulls script from an unrelated, unranked third-party domain

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain name 'pub-da0890dd4543473aa8e84f5a3c6e45bb.r2.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-da0890dd4543473aa8e84f5a3c6e45bb'. The second-level label 'r2' is 2 characters long containing zero vowels alongside one consonant; it also includes one digit. Tokenizing the label suggests 2 words: r, 2. Median word length comes out to 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.03s

Total Load Time

59 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:74%

Script:Latin

Direction:ltr

Detection Details

Text Length:28 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.94.41Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	172.232.24.161	Chicago, Illinois, United States	AS63949Akamai Connected Cloud
0	172.232.24.235	Chicago, Illinois, United States	AS63949Akamai Connected Cloud
0	104.18.95.41Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
5	6	-	-