pub-cb72691642c444eb900a44aa1d8a7107[.]r2[.]dev

This domain, pub-cb72691642c444eb900a44aa1d8a7107.r2.dev, is flagged as a high-risk phishing site impersonating Outlook login pages. The threat involves a fake authentication portal designed to harvest credentials from unsuspecting users. Infrastructure analysis reveals the domain mimics legitimate Microsoft services, likely targeting corporate or personal email accounts to gain unauthorized access, exfiltrate sensitive data, or propagate further attacks such as business email compromise (BEC) or malware distribution. The page title explicitly displays "Outlook," reinforcing the deception by closely resembling the legitimate login interface of Microsoft's email service. Analysis indicates the domain is hosted on Cloudflare R2 and resolves to the IPv6 address 2606:4700:3117::6812:3222. Detection metrics show 15 out of 95 security vendors on VirusTotal have flagged this domain as malicious, a significant indicator of its phishing nature. The domain appears on four distinct security blocklists, including PhishDestroy, PhishingArmy, PhishingDB, and OISD, further corroborating its malicious classification. The SSL certificate is issued by Let's Encrypt, a common tactic among threat actors to lend false legitimacy to phishing sites. Additional technologies detected include HTTP Strict Transport Security (HSTS) and Cloudflare infrastructure, which are often exploited to evade basic security checks. Users who visited this domain should assume their credentials may have been compromised. Immediate action is required: revoke any active sessions on the affected account, enable multi-factor authentication (MFA) if not already active, and monitor the account for unauthorized activity such as sent emails, rule modifications, or login attempts from unfamiliar locations. If corporate credentials were entered, notify the organization's security team to initiate an incident response protocol. Additionally, scan the device used to access the domain for malware or unauthorized software. Given the domain's high-risk classification and offline status, users should remain vigilant for similar phishing attempts, particularly those impersonating trusted brands or services.