pub-b0533a4f25fd47429514431d6c1a1d7b[.]r2[.]dev

This domain, pub-b0533a4f25fd47429514431d6c1a1d7b.r2.dev, is specifically flagged for fake login phishing. The domain is designed to mimic legitimate login pages, aiming to trick users into entering their credentials, which are then harvested by attackers for unauthorized access to accounts.

Analysis indicates that the domain was created on April 15, 2026, and is registered through Cloudflare R2. VirusTotal reports that 18 out of 95 security vendors flag this domain as malicious, highlighting a significant risk level. The domain appears on four security blocklists, including PhishDestroy, PhishingArmy, PhishingDB, and OISD. Additionally, the domain resolves to the IP address 104.18.54.45 and uses an SSL certificate from Let's Encrypt, which may give a false sense of security to users. The presence of HSTS (HTTP Strict Transport Security) and Cloudflare technologies suggests an attempt to enhance the domain's credibility and evade detection.

If users have visited this domain, they are advised to immediately change their passwords for any accounts they may have logged into. Additionally, users should monitor their accounts for any suspicious activity and consider enabling two-factor authentication (2FA) for added security. Reporting the incident to the respective service provider and running a full system scan for malware is also recommended to ensure no additional threats were introduced.