pub-d5295b49d0874fe9b32ead8cf37d2390[.]r2[.]dev

PhishDestroy investigated the domain pub-d5295b49d0874fe9b32ead8cf37d2390.r2.dev, which was flagged as a generic phishing threat. No specific brand or drainer kit was identified, but the domain exhibits clear malicious intent through its infrastructure and appearance on security blocklists. The page title returned 'Not Found', suggesting the content may have been taken down or hidden.

Technical analysis reveals that the domain is registered through Cloudflare R2 and was created on March 31, 2026. It resolves to IP address 104.18.54.45 and has an SSL certificate issued by Let's Encrypt (E7). VirusTotal reports a detection rate of 16 out of 95 security vendors, indicating moderate but significant detection. Additionally, the domain appears on two security blocklists and is not listed on Google Safe Browsing, though the status is marked as offline.

As of now, the domain is offline, likely taken down after being flagged. However, the risk remains elevated due to its recent creation and the potential for similar domains to emerge. Users should remain vigilant against unsolicited messages linking to Cloudflare R2 subdomains, as these are often used for phishing campaigns. PhishDestroy recommends monitoring for related infrastructure and blocking this domain at the network level.