pub-daaf0f3c335c477184cc201bdc5b89b3[.]r2[.]dev

This domain, pub-daaf0f3c335c477184cc201bdc5b89b3.r2.dev, has been assessed at an elevated risk level for generic phishing, specifically targeting user credentials through brand impersonation tactics. The threat analysis indicates that visitors may be tricked into entering sensitive information on fraudulent login pages. PhishDestroy categorizes this as a credential theft campaign, leveraging the trust associated with well-known brands to harvest personal data.

Technical indicators reveal a concerning profile: VirusTotal shows 17 out of 95 security vendors flagging this domain as malicious, a strong signal of community consensus on its threat nature. The domain was created on March 27, 2026, and is registered through Cloudflare R2, a service often abused for rapid domain setup. It resolves to IP address 104.18.54.45 and has already appeared on at least two security blocklists. Despite being taken offline, the domain's trust score remains critically low due to its short lifespan and negative reputation.

For users who may have encountered this domain, immediate mitigation steps are advised. Since the threat involves credential theft, change any passwords entered on the site and enable two-factor authentication on all accounts. Run a full antivirus scan on any device that accessed the domain. Monitor accounts for suspicious activity and report the incident to relevant brand authorities. Avoid clicking links in unsolicited messages and verify URLs before entering login credentials. PhishDestroy recommends continuous monitoring of security blocklists and browser extensions that detect known phishing domains.