ScanMalware.com

Security Scan Report: pub-0599a4b463c94302b7b0538a36dd379a.r2.dev

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/cd9b68bd-3aea-420b-9a51-2762f5dc343eDomain and IP registration (RDAP)/api/v1/rdap/cd9b68bd-3aea-420b-9a51-2762f5dc343eHow often this domain was scanned/api/v1/domain/stats/pub-0599a4b463c94302b7b0538a36dd379a.r2.devScan history for this domain/api/v1/domain/history/pub-0599a4b463c94302b7b0538a36dd379a.r2.dev?limit=15
This website contacted 6 IPs in 2 countries across 7 domains to perform 8 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-0599a4b463c94302b7b0538a36dd379a.r2.dev/servies.html

AI Security Verdict

Moderate Risk

Confidence: 85%

5
Risk Score

Fake cPanel 'Webmail Login' page hosted on a public R2 bucket, capturing email passwords and posting them to an unrelated external domain — a credential phishing kit.

Risk Factors (5)
Credential capture form (email + password) on cloud-storage hosted page
Brand impersonation of cPanel webmail on a non-official domain
Data submitted to an unrelated external endpoint (llcgarant.com/posts.php)
Public writable cloud bucket used as phishing hosting
Domain reputation unranked / no legitimate business footprint
Safety Factors (5)
No threat-intelligence Indicators of Compromise matched
No hunting rule JavaScript malware patterns detected
Some third-party scripts sourced from ranked CDNs
Some legal/informational text present
Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 9 to 5
Domain age information unavailable

Details

Page Title

Webmail Login

Scan Type

public

Domain Name Analysis

The domain 'pub-0599a4b463c94302b7b0538a36dd379a.r2.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-0599a4b463c94302b7b0538a36dd379a'. The registrable portion 'r2' spans 2 characters with 0 vowels and 1 consonant; it also includes 1 digit. Segmentation suggests 2 words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Screenshot not available

Page Load Overview

75.54s
Total Load Time
113 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:21%
Script:Latin
Direction:ltr

Detection Details

Text Length:1,303 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical45% confidence
Type: webapp
Method: ml+structural

All Detected Categories

healthcare medical
45%
technology software
45%
news media journalism
40%
adult content
37%
finance banking
35%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
189.116.147.123Paris, Île-de-France, France
AS47583Hostinger International Limited
1151.101.1.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.127.95Google · CDNUnited States
AS15169Google LLC
06--

Detected Technologies7

PasswordField
100%
JQueryv2.2.4
100%
Bootstrapv4.0.0
100%
Cloudflare
50%
jQuery CDN
20%
cdnjs
20%
Google Hosted Libraries
20%

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Average Hash:N/A
Perceptual Hash:N/A
Difference Hash:N/A
Wavelet Hash:N/A
Color Hash:N/A

Other Hashes

Crop Resistant:N/A

Scan History

Scan history not available

Unable to load historical scan data