Security Scan: Webmail Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/abb0480e-78bd-4908-b42f-dbf98c1793f6 Domain and IP registration (RDAP)/api/v1/rdap/abb0480e-78bd-4908-b42f-dbf98c1793f6How often this domain was scanned/api/v1/domain/stats/pub-eeea8d43d69b425aac2140009ecbbac5.r2.dev Scan history for this domain/api/v1/domain/history/pub-eeea8d43d69b425aac2140009ecbbac5.r2.dev?limit=15

This website contacted 7 IPs in 1 country across 5 domains to perform 16 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-eeea8d43d69b425aac2140009ecbbac5.r2.dev/icann-orndblk/st-or-hom.html

AI Security Verdict

Confirmed Scam

Confidence: 88%

Risk Score

Fake cPanel Webmail login hosted on a public Cloudflare R2 bucket, impersonating cPanel branding to harvest email and password credentials; obfuscated script and phishing lure confirm the scam.

Risk Factors (6)

Password/email credential form hosted on cloud-storage (r2.dev) rather than the branded provider's own domain

Impersonation of cPanel webmail login on a non-official domain

Session-expiry style lure ('Your session cookie is invalid. Please log in again.') pressuring re-entry of credentials

Obfuscated JavaScript flagged by two HIGH-severity IDS signatures

Unsolicited third-party domains referenced (cooltechem.com, lekutedrip.site)

No domain reputation and unverifiable page creation date on a shared bucket namespace

Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

The domain 'pub-eeea8d43d69b425aac2140009ecbbac5.r2.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-eeea8d43d69b425aac2140009ecbbac5'. The core label 'r2' covers 2 characters with zero vowels and 1 consonant, notching one digit. Tokenizing the label suggests 2 words: r, 2. Median word length is 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.96s

Total Load Time

2.9 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:1,358 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software49% confidence

Type: webapp

Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software

49%

documentation technical

29%

social_media

25%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.110.95Google · CDN	United States	AS15169Google LLC
2	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
2	192.185.129.241	Phoenix, Arizona, United States	AS46606Unified Layer
2	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.13.95Google · CDN	United States	AS15169Google LLC
2	151.101.65.155Fastly · CDN	United States	AS54113Fastly, Inc.
16	7	-	-