pub-16decabbb8a44a98875431d90ee884e6[.]r2[.]dev

Analysis of the domain pub-16decabbb8a44a98875431d90ee884e6.r2.dev shows that it is currently active and has been identified as a generic phishing threat. The domain is registered through Cloudflare, Inc., and resolves to the IP address 104.18.54.45, which belongs to the Cloudflare edge network. No authoritative name server information is available, as the nameserver query returned NS_NOT_FOUND.

The domain has been listed on a single security blocklist and was flagged by the PhishDestroy blocklist, indicating that at least one reputable anti‑phishing feed considers it malicious. VirusTotal has scanned the domain with 91 AV engines; none of the engines raised a detection at the time of scanning, but the absence of detections does not constitute a safety guarantee. No additional data such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, OTX indicators, or page title information have been disclosed, leaving those aspects uncertain.

Given the confirmed presence on a phishing blocklist and the lack of mitigating evidence, defenders should treat the domain as hostile. Recommended actions include adding the domain to deny‑list controls, monitoring DNS queries for the resolved IP, employing network‑level egress filtering to prevent outbound connections, and continuing to observe threat‑intel feeds for any new indicators that may emerge. Organizations should also consider reviewing any recent user activity that might involve this domain and, if necessary, initiate credential reset procedures for accounts that could have been exposed.