pubf868e77df61146e2a31924f0f62189d5[.]r2[.]dev

PhishDestroy identifies pubf868e77df61146e2a31924f0f62189d5.r2.dev as a credential phishing host designed to trick users into submitting login credentials. The domain uses a Let's Encrypt SSL certificate to appear legitimate, but security engines have not yet flagged it despite being active. This suggests the threat is still emerging and may evade detection temporarily.

This domain was flagged by PhishDestroy’s automated systems as a credential phishing site targeting login credentials. The domain resolves to a hosted storage bucket at r2.dev, a service often abused for rapid deployment of phishing pages. The SSL certificate issued by Let's Encrypt (not self-signed) indicates an attempt to appear trustworthy. VirusTotal reports 0 detections out of 95 engines as of latest scan, highlighting a window of opportunity for attackers before detection signatures mature.

If you visited pubf868e77df61146e2a31924f0f62189d5.r2.dev, immediately review any credentials entered. Change passwords on all related accounts, use two-factor authentication, and scan your device for malware. Report the domain to your organization’s security team or through PhishDestroy’s reporting tool to help block it. Avoid re-entering credentials on this domain and check for unusual activity in your accounts.