Security Scan: http://pub-cf8243e496b946db82fa4374d900d030.r

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ef42fb33-c158-4e07-81c9-cea0ab131563 Domain and IP registration (RDAP)/api/v1/rdap/ef42fb33-c158-4e07-81c9-cea0ab131563How often this domain was scanned/api/v1/domain/stats/pub-cf8243e496b946db82fa4374d900d030.r2.dev Scan history for this domain/api/v1/domain/history/pub-cf8243e496b946db82fa4374d900d030.r2.dev?limit=15

This website contacted 19 IPs in 1 country across 11 domains to perform 16 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: http://pub-cf8243e496b946db82fa4374d900d030.r2.dev/30064354gs4.html

Effective URL:

https://pub-cf8243e496b946db82fa4374d900d030.r2.dev/30064354gs4.html

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Confirmed phishing: a fake French login form on a public R2 bucket that ships entered credentials to a Telegram bot and geolocates visitors; Safe Browsing already flags it for social engineering.

Risk Factors (6)

Password harvesting form hosted on free, anonymous cloud-storage bucket (r2.dev) rather than an official domain

Telegram-bot exfiltration channel embedded in page JavaScript

Cross-origin call to ipinfo.io to fingerprint the victim

Hidden extra fields indicating a packaged phishing kit rather than a real login

Domain unranked in Cisco Umbrella and age attributable only to the hosting platform apex, not this page

IDS alerts for a commonly abused screenshot/thumbing service (image.thum.io) contacted by the page

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-cf8243e496b946db82fa4374d900d030.r2.dev' is registered with subdomain 'pub-cf8243e496b946db82fa4374d900d030'. The core label 'r2' covers 2 characters split between zero vowels and one consonant, notching 1 digit. It segments into 2 words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.89s

Total Load Time

921 KB

Total Size

Language Analysis

Primary Language

🇫🇷French

Code: fr

Confidence:51%

Script:Latin

Direction:ltr

Detection Details

Text Length:242 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: webapp

Method: structural

All Detected Categories

No categories detected

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
16	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	192.178.183.95Google · CDN	United States	AS15169Google LLC
0	151.101.129.155Fastly · CDN	United States	AS54113Fastly, Inc.
0	142.251.110.95Google · CDN	United States	AS15169Google LLC
0	172.64.147.188Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	104.17.25.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	142.251.150.119Google · CDN	United States	AS15169Google LLC
0	52.55.196.165Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
0	172.67.139.119Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
16	19	-	-