Security Scan Report: pub-0599a4b463c94302b7b0538a36dd379a.r2.dev

Submitted: Completed: publiccompleted
This website contacted 6 IPs in 2 countries across 7 domains to perform 9 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-0599a4b463c94302b7b0538a36dd379a.r2.dev/servies.html

AI Security Verdict

Confirmed Scam

Confidence: 90%

9
Risk Score

Fake cPanel webmail login on an anonymous R2 bucket that posts entered email credentials cross-origin to llcgarant.com — credential phishing, avoid and report.

Risk Factors (5)
Credential-harvesting login page hosted anonymously on shared cloud storage
Cross-origin exfiltration to llcgarant.com from inline scripts
Impersonation of cPanel webmail branding on a non-official domain
No legitimate site content, about page, or organizational identity
Suricata MEDIUM informational alerts for R2 public-bucket usage in DNS/TLS
Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

The domain name 'pub-0599a4b463c94302b7b0538a36dd379a.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-0599a4b463c94302b7b0538a36dd379a'. The registrable portion 'r2' spans 2 characters split between zero vowels and 1 consonant, notching one digit. Breaking it apart gives 2 words: r, 2. Median word length comes out to one character. No strong language cues emerged from the frequency lists.

Screenshot

Screenshot not available

Page Load Overview

75.42s
Total Load Time
113 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:21%
Script:Latin
Direction:ltr

Detection Details

Text Length:1,303 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical45% confidence
Type: webapp
Method: ml+structural

All Detected Categories

healthcare medical
45%
technology software
44%
news media journalism
40%
adult content
36%
finance banking
35%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
189.116.147.123Paris, Île-de-France, France
AS47583Hostinger International Limited
1151.101.1.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.20.95Google · CDNUnited States
AS15169Google LLC
06--

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Average Hash:N/A
Perceptual Hash:N/A
Difference Hash:N/A
Wavelet Hash:N/A
Color Hash:N/A

Other Hashes

Crop Resistant:N/A

Scan History

Scan history not available

Unable to load historical scan data