Security Scan Report: api.bubble.redcactus.nl

Redirected to:
https://portal.eu.redcactus.cloud/login
Site favicon
Submitted: Sep 21, 2026, 9:05:04 PMCompleted: Sep 21, 2026, 9:05:25 PMpubliccompleted

This website contacted 4 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main domain is portal.eu.redcactus.cloud and was registered 18 years ago.

Submitted URL: https://api.bubble.redcactus.nl

Effective URL:

https://portal.eu.redcactus.cloud/login
Redirected

The Cisco Umbrella rank of the primary domain is #951,887 of the top 1 million websites

AI Security Verdict

Low Risk

Confidence: 62%

3
Risk Score

Legitimate self-branded Red Cactus SSO login; form posts to the same company's own portal domain. No Indicators of Compromise, malware, or impersonation found. Final domain age unknown, so mild caution only.

Risk Factors (1)
Credential (email + password) login form served on the redirected domain portal.eu.redcactus.cloud, whose age could not be verified
Safety Factors (4)
Self-branding: page identifies as 'Red Cactus', matching the company name across both domains
Cross-origin submission is a same-organization SSO hand-off, explicitly flagged as legitimate, not cross-site credential theft
No Indicators of Compromise, no YARA, no IDS, no obfuscated/suspicious JavaScript
Standard multi-provider authentication pattern (Google, Microsoft, email/password)
Domain age information unavailable

Details

Page Title

Login | Red Cactus

Scan Type

public

Domain Name Analysis

The domain 'api.bubble.redcactus.nl' uses the Dutch country-code top-level domain (.nl) with subdomain 'api.bubble'. The core label 'redcactus' covers 9 characters containing three vowels alongside six consonants. Tokenizing the label suggests two words: red, cactus. Expect 4.5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://api.bubble.redcactus.nl

Page Load Overview

0.70s
Total Load Time
427 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:213 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software74% confidence
Type: webapp
Method: ml+structural

All Detected Categories

technology software
74%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
420.157.115.79Azure · CLOUDAmsterdam, North Holland, Netherlands
AS8069Microsoft Corporation
2142.251.151.119Google · CDNUnited States
AS15169Google LLC
2142.251.150.119Google · CDNUnited States
AS15169Google LLC
2142.251.110.94Google · CDNUnited States
AS15169Google LLC
104--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T134E02B539CE1840815709750ACA1F02CC857954ADB95DD50B8C2047DAFD4BDB89A795C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6:h4hqIY7YvfAbpli7vkOWAyL1EOwFFIN0L8g02AMzuJL2zAqJmW/DLIhNBfNuB9d:hRjy7bWAk2FsI0fB4sqJmWwhNPG

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:1:0:cb30701b79e15b8e30b930ce51fde01c

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:183c3c3c3c3c3c18
Perceptual Hash:cc993366cc993366
Difference Hash:f0f0f0f0f0f0e0f0
Wavelet Hash:3c3c3c3c3c3c3c3c
Color Hash:#9653ac

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data