pub-1e5d76a3f07d40fca9aaa348be68acb6[.]r2[.]dev

This domain is flagged as a high-risk generic_phishing site, designed to deceive users into providing sensitive information. The domain impersonates a legitimate brand, aiming to harvest credentials, financial details, or other personal data from unsuspecting visitors.

Analysis indicates that the domain pub-1e5d76a3f07d40fca9aaa348be68acb6.r2.dev has been flagged by 16 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion among the security community. The domain was registered through Cloudflare R2 on April 09, 2026, and currently resolves to the IP address 104.18.54.45. It appears on 3 security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let's Encrypt, which is a common choice for phishing domains due to its ease of use and low cost.

If users have visited this domain, they should immediately change their passwords for any accounts that may have been compromised. Additionally, users should monitor their financial statements and credit reports for any unauthorized activity. It is recommended to run a full system scan using updated antivirus software and to report the visit to their respective security teams or organizations. Users should also avoid clicking on any links or entering personal information on similar suspicious domains in the future.