Security Scan: Signin to continue

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ed9391b8-7ede-4cc3-a986-53f7508585d0 Domain and IP registration (RDAP)/api/v1/rdap/ed9391b8-7ede-4cc3-a986-53f7508585d0How often this domain was scanned/api/v1/domain/stats/pub-c94901a072aa467bab48aec9868ed584.r2.dev Scan history for this domain/api/v1/domain/history/pub-c94901a072aa467bab48aec9868ed584.r2.dev?limit=15

This website contacted 5 IPs in 1 country across 4 domains to perform 6 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-c94901a072aa467bab48aec9868ed584.r2.dev/tomhardy/index.html

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Phishing page on an R2 bucket posing as a document preview: it harvests email and password and POSTs them cross-origin to iboymegapanel.com, corroborated by two HIGH ET PHISHING IDS alerts. Never enter credentials.

Risk Factors (5)

Credential-harvesting form exfiltrating email + password to an unrelated third-party domain

High-confidence phishing IDS signatures on the page

Document-preview pretext used to solicit email account credentials

Anonymous cloud-storage hosting with no attributable domain reputation

Password validation/normalization messaging designed to make the harvest look like a real mail login

Domain age information unavailable

Details

Page Title

Signin to continue

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-c94901a072aa467bab48aec9868ed584.r2.dev' is registered with subdomain 'pub-c94901a072aa467bab48aec9868ed584'. The second-level label 'r2' is 2 characters long holding zero vowels versus 1 consonant, along with one digit. Tokenizing the label suggests 2 words: r, 2. Median word length comes out to 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Sign in with your Email Credentials to view the document Email Address ‘Must be a valid email address. Password Your password must be at least 6 characters as well as contain at least one uppercase...

Page Load Overview

0.59s

Total Load Time

52 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:57%

Script:Latin

Direction:ltr

Detection Details

Text Length:332 chars

Detector Agreement:100%

Website Classification

Primary Category

news media journalism45% confidence

Type: webapp

Method: ml+structural+ocr_tiebreaker

All Detected Categories

news media journalism

45%

adult content

44%

documentation technical

44%

government public service

41%

healthcare medical

36%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.251.14.95Google · CDN	United States	AS15169Google LLC
1	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.10.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	5	-	-