pub-223719251411456dae7d3253c35184c9[.]r2[.]dev

pub-223719251411456dae7d3253c35184c9.r2.dev is currently listed as a high‑risk generic phishing site. The domain was registered on 2026‑04‑04 and is hosted behind Cloudflare R2, using a Let’s Encrypt certificate (E7) and resolving to IP 104.18.50.34, which maps to Cloudflare, Inc. in Canada. HTTP requests return a 403 status and the page title is “Forbidden”, indicating that the content is not publicly served. The domain appears on two public blocklists and has been blocked by PhishDestroy and PhishingDB. VirusTotal scans show 15 of 94 security vendors flag the domain as malicious, and Gridinsoft assigns a trust score of 0/100. The infrastructure suggests a typical abuse setup: a freshly created sub‑domain under the r2.dev namespace, leveraging Cloudflare’s edge network to obscure origin. No additional payload or phishing page content has been observed, and the exact target brand or lure remains unknown. Defenders should continue to block the domain at perimeter devices, update DNS blocklists with the provided IP and domain, and monitor for any new sub‑domains under the same r2.dev namespace. Additional analysis of any retrieved content should be performed if the site becomes reachable, and incident response teams should treat any credentials submitted to this domain as compromised.