pub-440c4187a64b43cab2dc668e266c8762[.]r2[.]dev

This domain, pub-440c4187a64b43cab2dc668e266c8762.r2.dev, is flagged as a credential theft operation designed to harvest login details from unsuspecting users. Analysis indicates the site likely mimicked a legitimate service to trick visitors into entering sensitive information such as usernames, passwords, or other authentication credentials. The infrastructure was structured to appear authentic, increasing the risk of successful exploitation for follow-on attacks like account takeovers or identity fraud. Infrastructure analysis reveals multiple red flags confirming its malicious nature. The domain was created on May 04, 2026, an unusually future-dated registration that may indicate an attempt to evade detection or appear legitimate. It resolves to IP address 104.18.54.45, hosted by a content delivery network known for providing anonymity to threat actors. The domain is registered through Cloudflare R2, a platform frequently abused for hosting phishing infrastructure. Security vendors have flagged this domain, with 17 out of 95 engines on VirusTotal detecting it as malicious. Additionally, it appears on two security blocklists, further validating its classification as a threat. If you visited pub-440c4187a64b43cab2dc668e266c8762.r2.dev or entered any credentials, immediate action is required. First, change passwords for any accounts accessed from the same device or network, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available to add an extra layer of security. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions, and report any suspicious behavior to the respective service providers. Scan the device used to visit the site with updated security software to detect and remove any potential malware. Finally, consider notifying relevant authorities or cybersecurity teams if the incident involved sensitive or corporate data.