pub-45a83f302a1943ed8d62418c2af947ef[.]r2[.]dev

Analysis indicates that the domain pub-45a83f302a1943ed8d62418c2af947ef.r2.dev is currently active and classified as a generic phishing site with an elevated risk rating. The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has flagged it. VirusTotal scans show that 14 of 91 scanning engines have reported malicious behavior, which reinforces the suspicion of phishing activity despite the majority of engines remaining silent.

The presence on a blocklist and the multi‑vendor detections suggest that the domain is being used to host fraudulent content, although no public details of the hosted pages, SSL certificates, or hosting infrastructure have been disclosed in the available intelligence. Because the domain is still active, security teams should continue to block it at network perimeters, DNS resolvers, and endpoint protection solutions. Monitoring for DNS queries to the r2.dev sub‑domain and correlating any user‑initiated HTTP requests with known phishing indicators may help to detect attempts to exploit the site.

Organizations that have observed traffic to this domain should consider isolating affected hosts, resetting compromised credentials, and reviewing authentication logs for signs of credential harvesting. Given the limited visibility into the underlying infrastructure, further investigation—such as passive DNS enrichment, WHOIS lookup, and active probing—may reveal additional Indicators of Compromise that can be added to detection rules. Defenders are advised to keep the blocklist entry up‑to‑date and to share any new findings with collective threat‑intelligence platforms to improve community‑wide protection.