pub-873fc6a3edb941c6a17f50911dfca518[.]r2[.]dev

PhishDestroy identifies the active credential theft domain pub-873fc6a3edb941c6a17f50911dfca518.r2.dev as a high-risk phishing infrastructure hosting a generic phishing campaign. This domain is currently active and leverages cloud storage deception to trick users into surrendering login credentials. The infrastructure masquerades as a legitimate R2.dev storage endpoint operated by Cloudflare, exploiting user trust in reputable cloud services to facilitate credential harvesting. This domain was flagged by 17 of 95 VirusTotal security vendors and is blocked by PhishingArmy, PhishingDB, and OISD, accumulating coverage on three distinct security blocklists. The domain resolves to IP address 104.18.54.45 and utilizes a Let's Encrypt SSL certificate to enhance authenticity. The domain was registered under Cloudflare, Inc. with no publicly visible creation date due to privacy protection. Trust scores for this domain are critically low across multiple threat intelligence platforms, reinforcing the elevated risk profile. The domain remains active and must be treated as hostile. Immediate actions include blocking the domain pub-873fc6a3edb941c6a17f50911dfca518.r2.dev and IP 104.18.54.45 at the network perimeter and endpoint levels. Users should avoid accessing this domain entirely. Organizations are advised to inspect DNS logs for recent resolutions to this domain or IP, audit endpoint security logs for any user attempts to access it, and enhance credential hygiene by enforcing multi-factor authentication and regular password rotation. Security teams are further encouraged to monitor threat feeds for updates and consider blocking the Let's Encrypt certificate authority chain used by this domain as a containment measure.