pub-1d766f54f60f4b1cb76860717d399ced[.]r2[.]dev

This domain, pub-1d766f54f60f4b1cb76860717d399ced.r2.dev, is flagged as an active generic phishing threat. Infrastructure analysis reveals it is hosted on Cloudflare R2, a platform frequently used for both legitimate and malicious content distribution. The domain resolves to IP address 104.18.54.45, though nameserver records return NS_NOT_FOUND, indicating potential misconfiguration or deliberate obfuscation.

As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports 15 of 91 security vendors flagging the domain as malicious, though the specific nature of the phishing content remains unconfirmed due to limited public analysis. No brand target or phishing kit details are currently available, and the exact page content has not been reviewed.

Defenders should treat this domain as elevated risk and prioritize blocking at the DNS or proxy level. Further investigation is recommended to determine if the domain is part of a larger phishing campaign or operating as a standalone threat. Given the Cloudflare R2 hosting, defenders may also monitor for additional domains leveraging the same infrastructure for similar malicious activity.