pub-0b05fc97993245c28a18cdbc620c3719[.]r2[.]dev

This domain, pub-0b05fc97993245c28a18cdbc620c3719.r2.dev, operates as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. Such sites typically mimic legitimate services, tricking victims into entering usernames, passwords, or financial details, which are then captured by threat actors for fraudulent activities, including account takeovers or identity theft. The site was configured to appear as an unauthorized access page, a common tactic to create urgency and bypass user skepticism. Analysis indicates the domain was hosted on Cloudflare R2 infrastructure, a storage service often abused for rapid deployment of malicious content due to its low cost and scalability. The site resolved to the IP address 104.18.50.34 and utilized a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Detection data from VirusTotal shows 17 out of 95 security vendors flagged this domain as malicious, a clear indicator of its fraudulent nature. Additionally, the domain appeared on one security blocklist and was taken offline following enforcement actions. Users who visited pub-0b05fc97993245c28a18cdbc620c3719.r2.dev should assume their credentials may have been compromised. Immediate steps include changing passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring accounts for unauthorized activity. If financial or personally identifiable information was submitted, affected individuals should report the incident to relevant authorities and consider credit monitoring services. Organizations should update their security policies to block this domain and its associated IP address, 104.18.50.34, to prevent further exposure.