pub-4b857e143fb64003a534ea2ef1a84400[.]r2[.]dev

The domain pub-4b857e143fb64003a534ea2ef1a84400.r2.dev was registered on February 21, 2026 and resolves to the IP address 104.18.50.34, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The hosting provider is Cloudflare, and the service advertises HSTS support, indicating transport‑layer security is enforced for connections to the site. The TLS certificate presented is issued by Let’s Encrypt under the E7 series, confirming the site uses a valid, publicly trusted certificate. An HTTP request to the domain returns a 404 status code, and the page title returned by the server is "Suspected phishing site | Cloudflare," suggesting the content has been flagged by Cloudflare as a phishing placeholder.

VirusTotal analysis shows that 11 of 93 security vendors have flagged the domain, providing a modest but notable detection rate across multiple scanning engines. The domain appears on a single external blocklist, specifically PhishDestroy, which has actively blocked the host. Current operational status is listed as offline, and the site is no longer accessible at the time of analysis.

While the available intelligence confirms the domain’s association with a suspected phishing placeholder and its presence on a reputable blocklist, the exact payload, targeted brand, or credential‑harvesting mechanism has not been observed beyond the title, leaving the specific phishing campaign details uncertain. Defenders should immediately add the domain to DNS and web‑filtering block policies, monitor for any re‑registration or resurrection of the host, and consider incorporating the domain hash into threat‑intel feeds to prevent future exploitation. Continuous re‑scanning with VirusTotal or similar services is advisable to capture any changes in detection scores should the site become active again.