Security Scan Report: pub-35d6e5ba87ee48edbe69f9300475902e.r2.dev

Site favicon
Submitted: Sep 26, 2026, 12:45:02 AMCompleted: Sep 26, 2026, 12:45:36 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 88%

9
Risk Score

Fake Network Solutions/OX webmail sign-in hosted on an anonymous Cloudflare R2 bucket, capturing usernames and passwords. Brand impersonation plus a credential form on cloud storage — do not enter credentials.

Risk Factors
Credential login form (username/password, plus 'Confirm new password') hosted on anonymous cloud-storage bucket
Impersonation of Network Solutions Professional Email (OX webmail) branding on a non-official domain
Cloud-storage hosting with password fields — high-risk phishing-kit pattern
Unranked domain with no reputation backing a claimed major-brand login
Obfuscated/hidden 'location' fields and multiple duplicate sign-in forms consistent with a repurposed phishing kit
Domain age information unavailable

Details

Page Title

Sign in - Professional Email

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-35d6e5ba87ee48edbe69f9300475902e.r2.dev' is registered, featuring subdomain 'pub-35d6e5ba87ee48edbe69f9300475902e'. The registrable portion 'r2' spans 2 characters containing zero vowels alongside one consonant, along with one digit. Segmentation suggests two words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://pub-35d6e5ba87ee48edbe69f9300475902e.r2.dev/verify.html

Page Load Overview

1.02s
Total Load Time
448 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,290 chars
Detector Agreement:100%

Website Classification

Primary Category

other81% confidence
Type: webapp
Method: ml+structural

All Detected Categories

other
81%
suspicious phishing
43%
malicious
34%
legitimate website
32%
e-commerce
29%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.110.95Google · CDNUnited States
AS15169Google LLC
1198.251.71.220United States
AS8560IONOS SE
1104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.127.95Google · CDNUnited States
AS15169Google LLC
55--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18884E6149310303E3863C46675D4B997BE16A01FD82A8FB6F52E94A807CE9D72237F76

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:UH07Q01FDk4sMt7QRXgPe5zCpFx1Za7t2+bO6QNDZ:UH0Q01FDk4sMt7QRXgPe5zCpl

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:396973:HSCYCmBwMZGAUYgdIyIBlQSRSoIVQABuEQAECAhDowoAAFht2AEUAI5A1jXiC7WoOFIE7BADlTpAYBBgAGYAAYOQMEbFgjIJ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:66e7ffe7e7e7e700
Perceptual Hash:b3d84ce662f258d8
Difference Hash:8c0c160d0e4d0c4c
Wavelet Hash:00e7c3c3e7e7e700
Color Hash:#761f93

Other Hashes

Crop Resistant:8c0c160d0e4d0c4c

Scan History

Scan history not available

Unable to load historical scan data