pub-f4bf4b5c581d4d2fae8ac6d8e8ea7310[.]r2[.]dev

PhishDestroy has flagged pub-f4bf4b5c581d4d2fae8ac6d8e8ea7310.r2.dev as a generic phishing threat with an elevated risk level. This domain was designed to deceive users into revealing sensitive information, though it does not impersonate a specific brand. The domain is currently offline, but its recent activity and infrastructure indicate a clear intent to conduct phishing campaigns.

Technical analysis reveals that the domain was created on April 12, 2026, and resolves to IP address 104.18.50.34. It was registered through Cloudflare R2, and its SSL certificate was issued by Let's Encrypt (E7). VirusTotal data shows that 16 out of 95 security vendors flag this domain as malicious. It appears on 2 security blocklists, and the page title displayed a generic "Not Found" message. These indicators collectively confirm the domain's malicious nature.

Users should avoid interacting with this domain or any links associated with it. If you have already visited the site, change your passwords immediately and monitor your accounts for suspicious activity. Enable two-factor authentication where possible and run a full antivirus scan. PhishDestroy recommends reporting any related phishing attempts to your email provider and the relevant authorities to help prevent future attacks.