pub-e3f0c19d1dcd408e98de83be89036299[.]r2[.]dev

This domain, pub-e3f0c19d1dcd408e98de83be89036299.r2.dev, is currently flagged as an active generic phishing threat specializing in credential harvesting. Analysis indicates the infrastructure is designed to impersonate legitimate login portals, tricking users into submitting sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The domain leverages social engineering tactics to mimic trusted services, increasing the likelihood of successful compromise for unsuspecting victims. Infrastructure analysis reveals the domain resolves to the IP address 104.18.50.34, a Cloudflare-associated endpoint commonly used to mask origin servers. As of the latest scan, VirusTotal reports 0 detections out of 95 security engines, suggesting the threat is either newly deployed or employs evasion techniques to avoid detection. The SSL certificate is issued by Let's Encrypt, a legitimate certificate authority, which adds a layer of perceived authenticity to the malicious site. No historical blocklist entries or prior abuse reports were identified, further indicating its recent activation or low visibility in threat intelligence feeds. Users who have visited pub-e3f0c19d1dcd408e98de83be89036299.r2.dev or entered credentials on the site should immediately revoke and reset all exposed passwords, particularly for accounts associated with financial, email, or corporate services. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Monitor connected systems for unusual activity, such as unauthorized logins or data exfiltration attempts. Network administrators should block the domain and its resolving IP at the perimeter level to prevent further exposure. If sensitive data was submitted, consider reporting the incident to relevant data protection authorities or cybersecurity response teams for further guidance.