pub-2a92347ea03e4260a6bb3d381381c037[.]r2[.]dev

The domain pub-2a92347ea03e4260a6bb3d381381c037.r2.dev, impersonating Microsoft, has been flagged as malicious by 16 out of 94 vendors on VirusTotal. It was first detected on April 1, 2026, the same day it was created, indicating a rapid deployment strategy. Despite its current offline status, its initial activity posed a significant threat to users by exploiting Microsoft's brand trust.

Hosted by Cloudflare with an IP address located in Canada, this domain was part of a larger phishing operation. The fact that it was flagged by PhishDestroy and PhishingDB underscores its malicious intent. The domain's quick takedown suggests effective monitoring and response by security teams, but also highlights the ongoing challenge of such impersonation schemes.

Phishing domains like this one exploit the narrow window between domain registration and inclusion in antivirus databases, typically 24-72 hours. PhishDestroy's upstream detection capabilities identified this threat early, allowing for timely intervention before widespread harm could occur. The platform's risk score of 73/100 further emphasizes the potential impact of this scam.

The use of Cloudflare R2 as a registrar and hosting provider is notable, as it reflects a trend where phishers leverage reputable services to lend legitimacy to their operations. While the domain is now offline, its existence serves as a reminder of the persistent threat posed by phishing campaigns and the importance of proactive detection and mitigation efforts.