pub-51f896deb233450089fc1a520e6ed957[.]r2[.]dev

This domain, pub-51f896deb233450089fc1a520e6ed957.r2.dev, poses a credential harvesting threat targeting users of cloud storage services. The site was designed to impersonate legitimate login portals, tricking visitors into entering sensitive account details such as usernames, passwords, or multi-factor authentication codes. While the page currently displays a 'Not Found' error, this may indicate temporary takedown or a cloaking mechanism to evade detection. The infrastructure was likely intended to capture and exfiltrate stolen credentials to an attacker-controlled server for further exploitation, including account takeovers or data theft. Analysis indicates the domain was registered on April 15, 2026, through Cloudflare R2, a storage service often used for hosting static content. It resolves to the IP address 104.18.50.34, associated with Cloudflare's infrastructure in California. The domain is flagged by 17 out of 95 security vendors on VirusTotal, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Let's Encrypt (serial number E7), suggests an attempt to appear legitimate, though the certificate itself does not validate the site's authenticity. The domain's creation date in the future (2026) may indicate an error in reporting or an attempt to obscure its true registration timeline. If you visited pub-51f896deb233450089fc1a520e6ed957.r2.dev or entered any credentials, take immediate action to secure your accounts. First, change passwords for any accounts accessed or entered on the site, prioritizing cloud storage, email, or financial services. Enable multi-factor authentication if not already active. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions. Clear browser cache and cookies to remove any residual session data. If the site was accessed on a corporate or shared device, notify your IT or security team to assess potential exposure. Avoid reusing passwords across multiple services, and consider using a password manager to generate and store unique credentials. Finally, report the domain to your organization's security team or relevant authorities to aid in broader mitigation efforts.