pub-bda0c66467384daeb36a5ade8cd6385b[.]r2[.]dev

PhishDestroy identifies pub-bda0c66467384daeb36a5ade8cd6385b.r2.dev as a live credential-harvesting portal currently distributing fake login pages to unsuspecting users. Security telemetry confirms the domain is actively resolving to 104.18.50.34 and presenting a Let's Encrypt SSL certificate to appear legitimate. Preliminary analysis suggests the infrastructure is being abused to harvest credentials under the guise of a trusted cloud storage service, with traffic potentially redirected from compromised advertisements or spoofed emails.

This domain was flagged by four independent threat intelligence feeds: OpenPhish, PhishingArmy, PhishingDB, and OISD. VirusTotal analysis shows zero detection across 95 engines, indicating this threat has evaded traditional antivirus coverage. Infrastructure mapping reveals the domain is hosted on Cloudflare R2, a legitimate cloud storage platform leveraged by threat actors to host malicious content. Despite its recent deployment, the domain has already been blacklisted by multiple security vendors, signaling rapid escalation in malicious activity.

Users who recently visited this domain should immediately scan their devices for malware and review any credentials entered on the site. Change passwords used on this page immediately and enable multi-factor authentication where possible. Disconnect from untrusted networks and monitor financial accounts for signs of credential misuse. Report any suspicious activity to your security team and avoid interacting with similar domains in the future. Consider using a password manager with phishing detection to prevent accidental submissions on counterfeit pages.