pub-4885c33e6e884e73b5babfc926d05d2c[.]r2[.]dev

This domain, pub-4885c33e6e884e73b5babfc926d05d2c.r2.dev, was identified as part of a phishing campaign designed to deceive users into disclosing credentials or sensitive information under the guise of cloud storage services. The site mimics legitimate file-sharing or storage platforms, leveraging familiar branding elements to lower user suspicion. Victims may be prompted to enter login details, payment information, or download malicious files, leading to account compromise, data theft, or unauthorized financial transactions. The threat poses elevated risk due to its targeting of enterprise and personal users relying on cloud-based storage solutions. Analysis indicates the domain was registered through Cloudflare R2 on March 31, 2026, an unusual creation date that may suggest domain spoofing or an attempt to bypass detection mechanisms. It resolves to the IP address 104.18.50.34, hosted by Cloudflare, Inc. in Canada, a common infrastructure choice for threat actors seeking to obscure their operations behind reputable providers. At the time of assessment, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while two independent blocklists, PhishDestroy and PhishingDB, have listed it as a confirmed phishing resource. The page title returned a 'Not Found' response, which may indicate the site was either taken down, moved, or configured to evade automated scanners. Users who visited pub-4885c33e6e884e73b5babfc926d05d2c.r2.dev should assume potential exposure and take immediate remediation steps. Disconnect the device from the network to prevent further data exfiltration. Run a full system scan using updated security tools to detect and remove any downloaded payloads or malware. Change passwords for all accounts accessed from the compromised device, prioritizing email, financial, and cloud storage services. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity and report any suspicious transactions to the relevant service providers. If credentials were entered, consider notifying the legitimate service to prevent account misuse.