pub-1c3a35bc3f574b6684c3e0a322c562b4[.]r2[.]dev

This domain, pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev, operates as a fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication interfaces, likely targeting corporate or financial service users. The phishing page employs obfuscated JavaScript to capture entered credentials and transmit them to a remote server, a common tactic in credential theft campaigns. Infrastructure analysis reveals the domain is registered through Cloudflare R2 and secured with a Let's Encrypt SSL certificate (serial E7). VirusTotal detection metrics show 20 out of 95 security vendors flagging this domain as malicious. The domain resolves to the IP address 104.18.50.34, hosted in a Cloudflare data center in California. It appears on two security blocklists and is actively blocked by multiple threat intelligence feeds. Users who visited this domain should immediately reset any credentials entered on the site. Check browser history for additional exposure to related subdomains or redirects. Monitor accounts for unauthorized access and enable multi-factor authentication where available. Network administrators should update firewall rules to block the domain and its resolving IP address to prevent further access attempts.