pub-ef47dfdc85ad463a911b6bde06661e80[.]r2[.]dev

Analysis of the domain pub-ef47dfdc85ad463a911b6bde06661e80.r2.dev, observed on July 24 2026, indicates that it is being used for generic phishing. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 404 status, suggesting that the malicious content is not publicly reachable at the time of testing. The domain is protected by a Let’s Encrypt certificate issued under the E7 profile, and Cloudflare’s HSTS header is present, confirming that the domain is served through Cloudflare’s edge network. DNS resolution points to IP 104.18.54.45, which belongs to AS13335, Cloudflare, Inc., located in the United States.

Registration details show that the domain was created on 21 February 2026 and is registered via Cloudflare, Inc., a common choice for fast‑flux or disposable phishing infrastructure. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain as malicious, reinforcing the phishing classification. Technologies identified include HSTS and Cloudflare, but no additional web‑application frameworks were detected.

The current operational status is offline, which may be a temporary takedown or a rotation of infrastructure. While the available data confirms phishing‑related activity, the specific lure, target brand, or credential‑harvesting page has not been captured, leaving those aspects uncertain. Defenders should continue to block the domain at network perimeters, monitor for re‑registration or new subdomains under the same apex, and consider adding the associated IP address to deny lists. Ongoing threat‑intel feeds should be consulted for any resurgence, and any internal alerts that reference this domain should be investigated as potential phishing attempts.