Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
pub-a327f9d03def4b07b51dba5303fc3620.r2.dev shows high-risk / scam indicators.
| What this site appears to be | A storage/bucket 'Not Found' (404) error page indicating the object is not publicly accessible. No forms, links, or commercial claims present. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 4 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 2 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website is a bare public-storage endpoint on a shared object-storage hosting domain. Its homepage returns only a "Not Found / Error 404 – Object not found" notice, explaining that the object does not exist or is not publicly accessible at the URL. The notice also asks whether the visitor owns the bucket and points to instructions for enabling public access. It presents no products, branding, forms or navigation, and no commercial purpose or business model is visible. It appears to be a raw storage address, perhaps one used to serve files, rather than a destination operated as a service.
Scam/Impersonation Risk
Contradictory signals are present, and they drive a clearly cautionary assessment. The address is blacklisted. Several independent security engines, including a major endpoint-security vendor, currently flag it as malicious or suspicious. The detections do not specify a threat category, so the listing cannot be narrowed to one named abuse type. Because the page itself shows nothing harmful, the more likely explanation is that content stored at or served from this storage endpoint is the source of the flags. The listing is still decisive for risk. No brand impersonation or conflicting legal identities were observed, and no login or payment forms exist. A small number of abuse reports were filed against one of the site's resolving addresses. These apply to a shared provider address used by many unrelated customers, so they are discounted and carry no weight against this site. Behaviourally, the page is thin yet generates heavy outbound traffic, with a very high share of requests going to external destinations and repeated background fetches. This is disproportionate to a 404 notice and reinforces the reputational concern. It does not by itself show data capture, since no sensitive-form, wallet or clipboard abuse was detected.
- Homepage: the only content is a 404 object-not-found notice of a few hundred characters, with no forms, links, or commercial claims.
- Reputation: the address is flagged malicious by multiple external security engines, which confirms the blacklisting.
- Reputation: abuse reports on the site's resolving address are attributed to a shared provider address and discounted.
- Homepage behaviour: three sandbox runs recorded a very high external request share and numerous external background fetches, with no hidden forms or credential-harvesting behaviour.
Regulatory Verification Notes
The site is not a regulated entity. It carries no license claim, no legal-entity name, no terms or about pages, and no registration details, so no legitimate operator can be tied to it. Ownership and governance are opaque. For a content-free storage endpoint this is expected and is not a finding of deception on its own. Here it removes any institutional mitigation that could offset the detections. No third-party broker or regulatory-register match exists, so no reputational signal from that quarter applies. The site's encryption is intact but gives no assurance about who operates it or what it serves.
- Homepage: no company name, license, or registration number is presented, and there are no legal or policy pages.
- Hosting: served from AS13335 (Cloudflare, Inc., US), registry ARIN.
- Transport security: TLS certificate issued by YE1 (domain-validated, DV), valid to 2026-12-06.
- Third-party broker data: no match found for this address.
What to Verify Next
Anyone who received this address should first confirm, through an independent channel, who sent it and why. They should not treat a bare storage URL as an official site of any company that referred them to it. If the address was supposed to deliver a document or file, the sender should be asked to supply it by another route. If the address belongs to the reader's own organisation, the owner should audit the bucket for unauthorised or malicious uploads, remove them, and request a fresh reputation review. Any official contact or support channel should be taken from an independently confirmed source.
- Homepage: the notice invites the bucket owner to change public-access settings, which indicates an owner-side action rather than any visitor-facing service.
- Reputation: the detections apply to the address as it stands, so the listing needs to be cleared before any re-assessment.
- Sandbox: no downloadable content or user flow was exposed on the landing page, so file contents remain unassessed.
Summary Verdict
The address carries an elevated risk posture. External threat detections decide the outcome, and nothing on the page offsets them. The site is not a recognisable service and has no verifiable operator. The error page itself is benign, but the reputation attached to the address is not.
Infrastructure Integrity
The site resolves entirely to edge servers of a major CDN/WAF provider in the United States, and the origin server was not observable. The edge addresses are shared with many unrelated customers. This is mitigating context only, because the provider's protections and bot screening do not offset current external threat detections, and they say nothing about what content is stored behind the edge.
Closing Assessment
At most, the page should be viewed read-only. No logins, credentials, payment details, or file downloads should be entrusted to this address until it is cleaned and its reputation is restored.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, page content, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Page content
- The page has very little readable content.Page content
rule:PAGE_CONTENT_THIN - The page has no description for search engines, which established sites usually provide.Page content
rule:PAGE_SEO_MISSING_META
03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The review of the page network activity found requests that look out of place.Behaviour in a sandbox
rule:BEHAV_GPT_SUSPICIOUS_NETWORK - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY
Signals weighed against the site
- AbuseIPDB: 2 reports on hosting IP 2606:4700:311b::6812:362d (Cloudflare, Inc., Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of pub-a327f9d03def4b07b51dba5303fc3620.r2.dev.
- The request stayed on pub-a327f9d03def4b07b51dba5303fc3620.r2.dev. It was not redirected to another domain. Clear
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | Not available |
| Country | Not available |
| Server IP | 2606:4700:311b::6812:362d |
| Name servers | Not available |
| CDN / edge network | Lookup incomplete |
| SSL issuer | YE1 |
| SSL expiry | 2026-12-06 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not available |
| Reputation | VirusTotal: 4 flagged | AbuseIPDB: 0% confidence, 2 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about pub-a327f9d03def4b07b51dba5303fc3620.r2.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.