pub-e55d00bbe3f740a58ef8bd646105b158[.]r2[.]dev

The domain pub-e55d00bbe3f740a58ef8bd646105b158.r2.dev was observed on July 23, 2026 and is currently offline. Analysis indicates the site was hosted on Cloudflare R2, as reflected by the registration path and the presence of Cloudflare‑provided technologies such as HTTP Strict Transport Security (HSTS) and the Cloudflare reverse‑proxy service. The domain resolves to the IPv6 address 2606:4700:311b::6812:3222, which belongs to AS13335, a Cloudflare network located in the United States. An SSL certificate issued by Let’s Encrypt (E8) was detected, confirming that TLS was in use at the time of capture. The HTTP response returned a 404 status code, suggesting the underlying content was not served when probed.

The page title returned by the server was "Dashboard - Mail Authentication," but no further content analysis is available. Security telemetry shows that 11 of 91 VirusTotal scanners flagged the domain, indicating a moderate level of malicious confidence across multiple vendors. Additionally, the domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk.

Nameserver information could not be retrieved (NS_NOT_FOUND). While the evidence points to a phishing‑related infrastructure, the exact target brand or credential‑harvesting method remains unknown due to the lack of page content. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the IPv6 address, and monitor for any re‑hosting attempts that might use the same Cloudflare R2 bucket. Continuous re‑scanning with multi‑vendor platforms is recommended to capture any changes in the domain’s status or payload delivery mechanisms.