pub-668942aad21b4decacc840ecfb0df6e1[.]r2[.]dev

Analysis of the domain pub-668942aad21b4decacc840ecfb0df6e1.r2.dev indicates active phishing infrastructure as of July 12, 2026. The domain, registered on March 29, 2026, resolves to 104.18.54.45 and is hosted on Cloudflare R2 infrastructure located in Canada. A 403 HTTP status and 'Not Found' page title suggest the site may be in a transitional or obfuscated state, though this does not diminish its risk. Security vendors have flagged the domain, with 17 of 94 detections on VirusTotal classifying it as malicious. It appears on two security blocklists, including PhishDestroy and PhishingDB, reinforcing its association with phishing activity. The SSL certificate, issued by Let's Encrypt, and the presence of HSTS and Cloudflare technologies are consistent with legitimate and malicious domains alike, offering no definitive indication of intent. No nameservers are currently configured, which may be a temporary misconfiguration or an attempt to evade detection. The domain's content remains unconfirmed, as no specific brand, scam type, or phishing kit has been identified in available data. Defenders should treat this domain as high-risk and consider blocking or monitoring traffic to it, particularly in environments where phishing mitigation is a priority. Further investigation into associated campaigns or payloads is recommended to determine the exact nature of the threat.