pub-b3f1d35d8c5647a6890a759ff187f857[.]r2[.]dev

The domain pub-b3f1d35d8c5647a6890a759ff187f857.r2.dev is currently active and has been identified as a generic phishing infrastructure. Registration data shows the domain was provisioned through Cloudflare, Inc., which also supplies the authoritative name service; the nameserver query returned NS_NOT_FOUND, indicating that standard DNS records are not publicly disclosed. Network resolution points to the IP address 104.18.54.45, an address associated with Cloudflare’s edge network, suggesting the site is hosted behind a CDN that can obscure the true backend location.

The domain appears on a single security blocklist, where it is listed by PhishDestroy, providing at least one external indication of malicious use. VirusTotal analysis, performed by 91 scanning engines, reported no detections; while this lack of signatures does not confirm benign behavior, it does indicate that the payload or page content has not yet triggered automated detection signatures. No additional intelligence such as Safe Browsing status, OTX attribution, SSL certificate details, HTTP response codes, or page title information is available, leaving those vectors unverified.

Given the limited but concrete evidence—Cloudflare registration, CDN‑based hosting, blocklist inclusion, and the absence of vendor detections—defenders should treat the domain as suspicious. Recommended mitigation steps include adding the domain to outbound filtering rules, monitoring DNS queries for resolution to 104.18.54.45, and employing heuristic or behavior‑based detection to catch potential phishing attempts that may not be captured by signature‑based tools. Continuous re‑evaluation is advised as additional telemetry becomes available.