ScanMalware.com

Security Scan Report: f005.backblazeb2.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/aad3de7d-03a8-482e-bf29-e86ac00cba74Domain and IP registration (RDAP)/api/v1/rdap/aad3de7d-03a8-482e-bf29-e86ac00cba74How often this domain was scanned/api/v1/domain/stats/f005.backblazeb2.comScan history for this domain/api/v1/domain/history/f005.backblazeb2.com?limit=15
This website contacted 1 IP in 1 country across 3 domains to perform 4 HTTP transactions. The main domain is backblazeb2.com and was registered 10 years ago.

Submitted URL: https://f005.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_z488504930608a266a41f0a1e_f100be89f294c5348_d20261104_m100004_c005_v0501051_t0011_u01793786404667#[email protected]

The Cisco Umbrella rank of the primary domain is #13,278 of the top 1 million websites

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Phishing kit hosted on Backblaze B2: a fake 'Portal' login form whose JavaScript forwards entered emails and passwords to a Telegram bot, with a victim email token in the URL. Confirmed credential theft.

Risk Factors (6)
Credential harvesting form (email + password) on a cloud-storage file-download URL, not a real portal
JavaScript exfiltrates entered credentials to a Telegram bot (messaging-bot exfiltration)
Victim/target email injected into URL fragment as a phishing tracking lure
Page hosted as a B2 object download rather than a legitimate application host
Obfuscated/auto-generated brand token used instead of any real organization identity
Page is serving an error (502 Bad Gateway / name resolution error) while still presenting a login form
Domain age information unavailable

Details

Page Title

Mail

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'f005.backblazeb2.com' is registered, featuring subdomain 'f005'. The core label 'backblazeb2' covers 11 characters split between 3 vowels and seven consonants, along with 1 digit. Word splitting yields four words: back, blaze, b, 2. Median word length is 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

502 Bad Gateway [Ermo -2] Name or service not known 59dd92da1e7437a917299bab33e29d108bab Portal Email Address nelarz@59dd92da1e7437a917299bab33e29d108bab.ne Password Enter your password LOGIN

Page Load Overview

0.64s
Total Load Time
11 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:99 chars
Detector Agreement:50%

Website Classification

Primary Category

phishing scam45% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

phishing scam
45%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4149.137.136.16United States
AS40401Backblaze Inc
41--

Detected Technologies2

PasswordField
100%
HSTS
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A2D1749B1563085066A7E0EC37E7A7093160C013AE49C8747F5CA79C8F4AE96E8B33CD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:Brl/+rNFMEFpF/9OAjBiJIFiLi3iebUnUn2iQuriyu4/:Br6FMEFpFVbFiLi3i0UnpiQ6iyb

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:6424:Q0RKCQAgFiFCgQVGAoQgoQwIqInUU1ABBLUCKSFAgypIJAiIB6ISIZCQAFIgDEQGhSmAAwFqBZqAxCpAYGxCpAM5hAQIcMAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7fffe7e3e7e7ffff
Perceptual Hash:a78d8923078d279f
Difference Hash:c0000c0c0c0c0008
Wavelet Hash:3f3f030324243c3c
Color Hash:N/A

Other Hashes

Crop Resistant:c0000c0c0c0c0008

Scan History

Scan history not available

Unable to load historical scan data