pub-97673970c1c145eda5e559c4f9c18f61[.]r2[.]dev

This domain, pub-97673970c1c145eda5e559c4f9c18f61.r2.dev, was operational as a generic phishing site designed to mimic legitimate cloud storage services. Analysis indicates the site likely aimed to harvest login credentials or distribute malicious payloads under the guise of file-sharing or data storage. Visitors were at risk of account compromise, data theft, or malware installation through deceptive prompts or fake authentication portals. The infrastructure was structured to exploit trust in cloud-based platforms, a common tactic in credential theft campaigns. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on April 26, 2026, through Cloudflare R2, a service often abused for hosting phishing content due to its low-cost and ephemeral nature. It resolved to the IP address 104.18.50.34, geolocated in Canada under Cloudflare, Inc., a provider frequently used to obscure hosting origins. At the time of detection, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while two independent security blocklists—PhishDestroy and PhishingDB—had already listed it. The SSL certificate, issued by Let's Encrypt (serial number E7), provided a false sense of security, a tactic commonly employed in phishing to evade browser warnings. Users who visited pub-97673970c1c145eda5e559c4f9c18f61.r2.dev should take immediate action to mitigate potential risks. If any credentials were entered, reset passwords for all associated accounts, particularly those linked to cloud services, financial platforms, or email. Enable multi-factor authentication where available to prevent unauthorized access. Scan the device used to visit the site with updated security tools to detect and remove any downloaded malware. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective service providers. Given the domain's current offline status, further direct exposure is unlikely, but users should remain vigilant against similar phishing attempts impersonating cloud storage or file-sharing services.