Security Report: pub-f8d3496ce8304e8393c189cffcf67835.r2.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a9fd279b-4985-49dd-a9be-99f74c0929c9 Domain and IP registration (RDAP)/api/v1/rdap/a9fd279b-4985-49dd-a9be-99f74c0929c9How often this domain was scanned/api/v1/domain/stats/pub-f8d3496ce8304e8393c189cffcf67835.r2.dev Scan history for this domain/api/v1/domain/history/pub-f8d3496ce8304e8393c189cffcf67835.r2.dev?limit=15

This website contacted 11 IPs in 3 countries across 7 domains to perform 18 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: http://pub-f8d3496ce8304e8393c189cffcf67835.r2.dev/index.html

Effective URL:

https://pub-f8d3496ce8304e8393c189cffcf67835.r2.dev/index.html

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 82%

Risk Score

Static fake webmail login on a Cloudflare R2 bucket whose script posts credentials to an unrelated temporary.site endpoint — a credential-phishing page. Do not enter any password.

Risk Factors (5)

Credential-harvesting login form on a free/instant cloud-storage bucket

Cross-origin POST target on unrelated temporary.site domain with a spoofed WordPress path

Right-click blocking / anti-analysis JavaScript

Generic webmail branding on a domain that is not a mail provider

Host and bucket unranked with no attributable domain age (shared r2.dev tenant)

Domain age information unavailable

Details

Page Title

Webmail :: Welcome to Webmail

Scan Type

public

Favicon Hash

MMH3: -1754690812

MD5: 924a68d347c80d0e502157e83812bb23

Domain Name Analysis

The domain 'pub-f8d3496ce8304e8393c189cffcf67835.r2.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'pub-f8d3496ce8304e8393c189cffcf67835'. The registrable portion 'r2' spans 2 characters with 0 vowels and 1 consonant; bonus characters include one digit. Splitting it apart reveals two words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.68s

Total Load Time

282 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:198 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical42% confidence

Type: webapp

Method: ml+structural

All Detected Categories

documentation technical

42%

phishing scam

40%

technology software

40%

adult content

32%

news media journalism

30%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	194.191.24.191	Switzerland	AS1836green.ch AG
1	23.53.40.209Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
1	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	72.1.32.141Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	23.53.42.17Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
18	11	-	-