pub-9e0941be2dbe4b4db8ae1075803a2cfc[.]r2[.]dev

The domain pub-9e0941be2dbe4b4db8ae1075803a2cfc.r2.dev was identified as a generic phishing site posing an elevated risk. It did not impersonate a specific brand or deploy a known drainer kit. As of the latest verification, pub-9e0941be2dbe4b4db8ae1075803a2cfc.r2.dev has been taken offline, reducing immediate exposure to users.

Technical analysis revealed that 3 of 95 VirusTotal security vendors flagged pub-9e0941be2dbe4b4db8ae1075803a2cfc.r2.dev as malicious, including ADMINUSLabs, alphaMountain.ai, and Sophos. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 104.18.54.45, hosted by Cloudflare in the US. It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Let's Encrypt (E7). The observed page title was 'Not Found', with an HTTP 404 status, and technologies such as HSTS and Cloudflare were detected.

Users who may have interacted with pub-9e0941be2dbe4b4db8ae1075803a2cfc.r2.dev should take immediate action to secure their accounts. For credential phishing, change passwords on any sites where the same credentials were used, enable two-factor authentication, and monitor accounts for unauthorized activity. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to assist in broader mitigation efforts.