pub-f797f02db53d4ff0b48db234d2ff6780[.]r2[.]dev

The domain pub-f797f02db53d4ff0b48db234d2ff6780.r2.dev has been identified as a potential generic phishing threat, currently under investigation by PhishDestroy. While the specific brand being impersonated has not yet been determined, the domain's structure and registration through Cloudflare R2 suggest it may be used for credential harvesting or other deceptive schemes. The page title returned a "Not Found" error, which could indicate that the landing page was taken down or is being cloaked to avoid detection. This domain is now offline, but its previous activity warrants caution.

Evidence gathered during the analysis includes several key indicators. VirusTotal scans show 0 detections out of 95 security vendors, meaning the domain has not yet been flagged by major antivirus engines. However, it appears on 1 security blocklist, suggesting some automated systems have already identified it as suspicious. The domain resolves to IP address 104.18.50.34 and uses an SSL certificate issued by Let's Encrypt (E8), which is common among phishing sites due to its free and automated issuance. The registrar is Cloudflare R2, a service often abused for hosting malicious content due to its ease of use and anonymity.

Users who may have visited this domain should take immediate action. If any credentials or personal information were entered, they should be changed on the legitimate sites immediately. It is also recommended to run a full antivirus scan and monitor financial accounts for unusual activity. PhishDestroy advises all users to verify any suspicious URLs through its platform before interacting with them. Staying vigilant and reporting such domains helps protect the broader online community from evolving phishing threats.