ScanMalware.com

Security Scan Report: pub-c83f9fae7dea4ca09fefa3e6ff17706f.r2.dev

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/fdd363d8-9873-4cc5-8aca-3b6ab5ff106aDomain and IP registration (RDAP)/api/v1/rdap/fdd363d8-9873-4cc5-8aca-3b6ab5ff106aHow often this domain was scanned/api/v1/domain/stats/pub-c83f9fae7dea4ca09fefa3e6ff17706f.r2.devScan history for this domain/api/v1/domain/history/pub-c83f9fae7dea4ca09fefa3e6ff17706f.r2.dev?limit=15
This website contacted 11 IPs in 3 countries across 9 domains to perform 10 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-c83f9fae7dea4ca09fefa3e6ff17706f.r2.dev/abrasive/accurate.html

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

DocuSign-branded credential phishing on an unrelated r2.dev bucket: fake urgency plus a fabricated 'email authentication failed' error to harvest the victim's email password. Do not enter credentials.

Risk Factors (5)
Impersonation of the DocuSign brand on a non-DocuSign domain
Credential (password) capture form hosted on a Cloudflare R2 public bucket
Fabricated error message used to re-solicit the password
Deceptive urgency ('required to complete an authentication')
Cloud-storage/shared-tenant hosting with unknown true page age and no domain reputation
Domain age information unavailable

Details

Page Title

DocuSign Login - Enter your password to sign in

Scan Type

public

Domain Name Analysis

The domain name 'pub-c83f9fae7dea4ca09fefa3e6ff17706f.r2.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'pub-c83f9fae7dea4ca09fefa3e6ff17706f'. The second-level label 'r2' is 2 characters long holding 0 vowels versus 1 consonant; bonus characters include 1 digit. It segments into two words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

DocuSign DocuSign i\ You are required to complete an authentication in order to proceed! kindly confirm action by choosing below. DocuSign Login with DocuSign Login with my email This authentica...

Page Load Overview

1.31s
Total Load Time
512 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:557 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical35% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical
35%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
10104.18.50.34Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0104.18.54.45Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0141.193.213.21Cloudflare · CDNUnited States
AS209242Cloudflare London, LLC
0185.111.111.158Frankfurt am Main, Hesse, Germany
AS212238Datacamp Limited
0172.64.144.112Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0187.127.201.248Kuala Lumpur, Kuala Lumpur, Malaysia
AS47583Hostinger International Limited
0172.64.147.160Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0142.251.13.95Google · CDNUnited States
AS15169Google LLC
0104.18.36.77Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
0170.114.78.89Cloudflare · CDNUnited States
AS209242Cloudflare London, LLC
1011--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BB448B3249239C2708DED5C7591D6FDA7FA4CDCB46316223B07C818CA791AF22D9A25F

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:gajpSYt72uB8zd3nuatHiuZ1aYxs7TA7VmserIxzFJkzFuOtHXf5n:ga1SYtRc33CMaoQTA7Vmserr

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:256324:uIABvCACBQQRDSgEZBQcxIKYwQB1GBSCA0iKwggLBGBrSYJAkQAqiQEpMQZElFobDgIAxkgLJnAwCnwFBQhMIhqQAEwIGiAE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7fffe7efe3ffffef
Perceptual Hash:b38f8c253399c666
Difference Hash:883228484d20308c
Wavelet Hash:7f3c3424243c3cee
Color Hash:070000001c0

Other Hashes

Crop Resistant:883228484d20308c

Scan History

Scan history not available

Unable to load historical scan data