Security Scan: Microsoft Sign-in Redirect

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f6888432-5566-4a71-8f29-608983d613b9 Domain and IP registration (RDAP)/api/v1/rdap/f6888432-5566-4a71-8f29-608983d613b9 Certificate Transparency/api/v1/ct/pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev How often this domain was scanned/api/v1/domain/stats/pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev Scan history for this domain/api/v1/domain/history/pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev?limit=15

This website contacted 11 IPs in 1 country across 6 domains to perform 11 HTTP transactions. The main domain is pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev and was registered 7 years ago.

Submitted URL: https://pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev/index.html?8b8ee873ab9b03b01a6ad872d18764

AI Security Verdict

High Risk

Confidence: 82%

Risk Score

Fake Microsoft sign-in redirect page on a public Cloudflare R2 bucket, flagged as phishing by threat intel; impersonates Microsoft's authentication flow with obfuscated JS. Do not enter credentials.

Risk Factors (5)

Impersonation of Microsoft's sign-in flow on a non-Microsoft domain hosted on a public Cloudflare R2 bucket

Single-source phishing threat-intel hit on the page's primary domain

Dynamic code execution via 5 eval() calls

Unranked domain (not in Cisco Umbrella top 1M), shared-hosting tenant with unknown true age

Displayed security-check / invalid-session messaging designed to push users toward re-authentication

Domain age information unavailable

Details

Page Title

Microsoft Sign-in Redirect

Scan Type

public

Domain Name Analysis

The domain name 'pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'pub-e66b4b88b1d24aeeaf754f0ecee122c7'. Its registrable label 'r2' stretches across 2 characters holding zero vowels versus 1 consonant; bonus characters include one digit. Breaking it apart gives two words: r, 2. Median word length is one character. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.03s

Total Load Time

785 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:156 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software67% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

67%

corporate business

38%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	172.67.68.11Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.1.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	13.107.246.44Azure · CLOUD	United States	AS8075Microsoft Corporation
1	104.18.38.252Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	18.66.102.87Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
1	104.18.54.45Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.26.3.143Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.0.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.26.2.143Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
11	11	-	-