pub-a02f382113904779a1c33d9626af1228[.]r2[.]dev

PhishDestroy identifies pub-a02f382113904779a1c33d9626af1228.r2.dev as an active Microsoft 365 credential harvesting scam. This domain is currently engaged in phishing operations designed to mimic legitimate Microsoft login pages, tricking users into surrendering their corporate or personal credentials.

This domain resolves to IP 104.18.54.45 and utilizes a Let's Encrypt SSL certificate for added authenticity. VirusTotal analysis flags the domain as malicious, with 5 of 95 security vendors detecting its phishing nature. The domain is hosted on Cloudflare's R2 storage service, a legitimate platform often exploited by threat actors to host malicious content under seemingly innocuous subdomains.

Users and organizations are strongly advised to avoid interacting with this domain and block access at the network level. If credentials were entered, immediately reset passwords and enable multi-factor authentication for affected accounts. Report the domain to your security team or via PhishDestroy's reporting tool for further analysis. Monitor accounts for unusual activity and consider implementing DNS-level blocking for similar domains.