pub-b778210b76e7433886ec399564e5d4a5[.]r2[.]dev

pub-b778210b76e7433886ec399564e5d4a5.r2.dev is currently listed as a high‑risk social‑engineering site. Google Safe Browsing has classified the domain under the “social engineering” category, indicating that it is being used to trick users into disclosing credentials or personal information. The domain is hosted behind Cloudflare, Inc., which is the registrar and also provides the DNS front‑end; the authoritative nameserver information could not be resolved, as NS records return “NS_NOT_FOUND”. Network resolution shows the domain pointing to the IP address 104.18.54.45, a host commonly associated with Cloudflare edge nodes.

The address appears on one public security blocklist and is actively blocked by the PhishDestroy feed, confirming its presence in at least one community‑maintained blacklist. VirusTotal has recorded fifteen positive detections out of ninety‑one submitted scanners, demonstrating that a non‑trivial subset of AV engines consider the domain malicious. No additional metadata such as page title, SSL certificate details, or HTTP response codes have been published, leaving the exact content of the site unverified.

Consequently, analysts cannot confirm the specific luring technique or any credential‑capture pages that may be served. Defenders should continue to block the domain at network perimeters, update DNS filtering policies to include the observed IP and associated CIDR ranges, and monitor for any new indicators that may appear in additional sandbox or intelligence feeds. Given the active status and high risk rating, organizations are advised to treat any traffic to this host as malicious and to educate users about the risks of unsolicited links that resolve to Cloudflare‑protected domains flagged for social engineering.