Security Scan: Webmail Login

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/c794a412-5425-4410-995b-2c2433f39184 Domain and IP registration (RDAP)/api/v1/rdap/c794a412-5425-4410-995b-2c2433f39184How often this domain was scanned/api/v1/domain/stats/pub-2cd796e07737407a9447e3735195d740.r2.dev Scan history for this domain/api/v1/domain/history/pub-2cd796e07737407a9447e3735195d740.r2.dev?limit=15

This website contacted 8 IPs in 2 countries across 6 domains to perform 14 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-2cd796e07737407a9447e3735195d740.r2.dev/xxxwebxxx.html

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Fake cPanel webmail login hosted on a Cloudflare R2 bucket that posts entered credentials to an unrelated third-party domain; HIGH IDS phishing alerts confirm a credential-phishing kit.

Risk Factors (5)

Brand impersonation of cPanel webmail on a non-cPanel domain

Credential form on shared cloud storage with cross-origin data POST to an unrelated domain

High-severity IDS phishing alerts (generic phishing landing, XHR credential-post kit)

Form action javascript:void(0) with hidden fields, a common kit pattern to intercept submitted credentials

Page tenant on r2.dev has no attributable age or reputation; unranked domain

Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

You're looking at domain 'pub-2cd796e07737407a9447e3735195d740.r2.dev' on the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-2cd796e07737407a9447e3735195d740'. The registrable portion 'r2' spans 2 characters with zero vowels and 1 consonant; it also includes 1 digit. Segmentation suggests two words: r, 2. Average segment length settles at one character. No strong language cues emerged from the frequency lists.

Screenshot

Webrnai/ Email Address 2 Enter your email address. Password A Enter your email password. English aul === eStina dansk ==» Deutsch = EAAnvik& = espafiol_-—espaifol latinoamericano <P Copyright©...

Page Load Overview

1.46s

Total Load Time

205 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:1,384 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software29% confidence

Type: webapp

Method: ml+structural

All Detected Categories

technology software

29%

social_media

25%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	184.154.215.138	United States	AS32475Internap Holding LLC
1	151.101.193.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	2.21.20.133Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
1	151.101.65.155Fastly · CDN	United States	AS54113Fastly, Inc.
1	23.216.77.30Akamai · CDN	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
14	8	-	-