pub-328b2c608f85458baef54afef68fbb4a[.]r2[.]dev

pub-328b2c608f85458baef54afef68fbb4a.r2.dev is classified as a high-risk phishing domain. It actively attempts to deceive users by mimicking legitimate sites or services to steal sensitive information such as login credentials, financial data, or personal details. The threat posed is significant due to the domain’s confirmed presence on multiple security blocklists and detection by various antivirus engines.

According to available intelligence, this domain is flagged by 16 out of 95 VirusTotal security vendors, indicating a strong consensus on its malicious nature. It is listed on at least three reputable security blocklists: OpenPhish, PhishingArmy, and OISD, which specialize in identifying phishing threats. The domain uses a Let's Encrypt SSL certificate, which provides encryption but does not validate the domain’s legitimacy. It resolves to the IP address 104.18.54.45, which is associated with cloud hosting services often exploited by threat actors. Although details about its registrar or creation date are not specified here, the domain’s inclusion on multiple blocklists and vendor detections underline its untrustworthiness.

To mitigate risks associated with pub-328b2c608f85458baef54afef68fbb4a.r2.dev, users should refrain from visiting this domain or submitting any personal or financial information if encountered. Organizations should consider blocking the IP and domain at their network perimeter and keep endpoint security solutions updated to detect phishing attempts. Additionally, educating users on recognizing phishing indicators—such as unexpected requests for credentials or suspicious URLs—can reduce the likelihood of successful exploitation. Continuous monitoring using threat intelligence feeds that include this domain will help maintain strong defenses against this phishing threat.