pub-e66b4b88b1d24aeeaf754f0ecee122c7[.]r2[.]dev

PhishDestroy identifies pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev as an active credential theft phishing domain currently under investigation with a high risk profile. This subdomain mimics legitimate cloud storage or service authentication portals to harvest user credentials, posing a direct threat to account security. The domain leverages compromised or fraudulent cloud infrastructure to bypass traditional security controls, making it a critical concern for both individuals and organizations. Immediate action is strongly recommended to prevent potential data breaches or identity theft. This domain was flagged by multiple independent security researchers and blocklist providers, including VirusTotal with 16/95 detections (indicating low AV coverage), PhishingArmy, and OISD. It resolves to IP address 104.18.50.34, which is associated with Cloudflare’s edge network. The domain utilizes a Let's Encrypt SSL certificate, adding a false sense of legitimacy. While the specific creation date is not provided in available threat intelligence, its active status and inclusion on two major blocklists suggest recent deployment. The absence of detections on VirusTotal highlights a concerning gap in automated detection capabilities, emphasizing the need for behavioral and reputation-based monitoring. To mitigate the risk posed by this credential theft phishing domain, users should avoid interacting with the site entirely. Organizations should immediately update firewall and proxy rules to block access to 104.18.50.34 and the domain pub-e66b4b88b1d24aeeaf754f0ecee122c7.r2.dev. It is also advisable to inspect network logs for any outbound connections to this IP or domain. Users who may have entered credentials should immediately change passwords on all affected accounts and enable multi-factor authentication where possible. Reporting the domain to PhishingArmy and OISD can help improve collective security by accelerating its removal from other blocklists. Exercise heightened vigilance for similar phishing campaigns using cloud service impersonation tactics.