Security Scan Report: pub-24b7cfe9f8124685b0d6cdc68c27906f.r2.dev

Submitted: Sep 28, 2026, 3:53:41 PMCompleted: Sep 28, 2026, 3:55:20 PMpubliccompleted

AI Security Verdict

Low Risk

Confidence: 62%

3
Risk Score

Self-branded logistics site on a Cloudflare R2 bucket with only order-tracking/contact forms and no credential, payment, malware or Indicator-of-Compromise evidence; unknown page age keeps it at low risk.

Risk Factors (3)
Hosted on cloud storage (R2 public bucket) rather than a registered business domain — hosting signal that only escalates when combined with credential forms or impersonation, neither of which is present
Unranked in Cisco Umbrella and the page's true age is unknown (shared-hosting tenant)
25 eval()/dynamic-code calls and cross-origin POST to index.buffaloex.com (same operator's brand domain) — common framework/marketing behaviour, not exfiltration
Safety Factors (5)
Consistent self-branding: title, meta description and site content all describe the same 'BUFFALO International Logistics' operator
Rich, coherent legitimate content: freight services, overseas warehouses, order tracking, FAQs, news articles, charity event
No credential harvesting, no payment collection, no password fields, no credential exfiltration detected
Third-party scripts served from top-1M ranked hosts (Google, YouTube, Facebook CDN) consistent with a normal commercial site
Brand check passed — brand mentions are the site's own, not another entity's
Domain age information unavailable

Details

Page Title

BUFFALO International Logistics - We Deliver Hope

Scan Type

public

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'pub-24b7cfe9f8124685b0d6cdc68c27906f.r2.dev' is registered, featuring subdomain 'pub-24b7cfe9f8124685b0d6cdc68c27906f'. The registrable portion 'r2' spans 2 characters holding 0 vowels versus 1 consonant, notching 1 digit. Tokenizing the label suggests two words: r, 2. Average segment length settles at 1 character. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://pub-24b7cfe9f8124685b0d6cdc68c27906f.r2.dev/home.html

Page Load Overview

37.09s
Total Load Time
7.0 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:64%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:zh-CN
Text Length:9,266 chars
Detector Agreement:100%
Language mismatch: Declared as zh-CN but detected as en

Website Classification

Primary Category

unknown0% confidence
Type: spa
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4159.138.177.104Johannesburg, Gauteng, South Africa
AS136907HUAWEI CLOUDS
4148.153.240.71United States
AS63199CDS Global Cloud Co., Ltd
4142.250.154.97Google · CDNUnited States
AS15169Google LLC
4142.251.157.4Google · CDNUnited States
AS15169Google LLC
4157.240.0.6Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
4216.239.32.36Google · CDNUnited States
AS15169Google LLC
4157.240.0.35Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
4159.138.177.46Johannesburg, Gauteng, South Africa
AS136907HUAWEI CLOUDS
4159.138.177.198Johannesburg, Gauteng, South Africa
AS136907HUAWEI CLOUDS
19447--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T147731A2265F120274993C2D6BA606F1B7F82E68BC90B1A4472FC0BE55FC3D96CD17269

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:VkYuTJC896SKxe7Hh5s4uaBjhIscToRVj6FS85iZi30qYKIW7P/Z40Lp20wIWYIR:ATJCg6Q7B5luaffpS5WQsSSN7KEl5Bcg

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:77909:ACY0oFZSIFIHVQAgbWoBrowgIhgyJ7CIQc4sw1AxVMYNQAozEFARNQKGJBZKQi0K+ALABKIiRsBAaEAttEIkxIoAwJqeAFgV

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7e7f7f7f7f7f7f3f
Perceptual Hash:80c007fd0ff03ff1
Difference Hash:c0808080c08080e0
Wavelet Hash:3e7e7e7e02424202
Color Hash:#57ac53

Other Hashes

Crop Resistant:c0808080c08080e0

Scan History

Scan history not available

Unable to load historical scan data