pub-41dcc2b0c242484a90a139557123d677[.]r2[.]dev

PhishDestroy identifies pub-41dcc2b0c242484a90a139557123d677.r2.dev as an active credential theft phishing site hosting fraudulent login pages designed to harvest user credentials. Security research shows this domain is weaponized in generic phishing campaigns, often mimicking legitimate services to trick victims into surrendering sensitive information. Attackers frequently abuse cloud storage subdomains like this to lend false legitimacy to their schemes, using familiar hosting providers to bypass initial scrutiny. This domain was flagged by PhishDestroy after being blocked by three leading threat intelligence feeds — PhishingArmy, PhishingDB, and OISD — and detected by 16 out of 95 VirusTotal security engines within hours of activation. The domain resolves to IP address 104.18.50.34 and uses a valid Let’s Encrypt SSL certificate to appear authentic. While the exact creation date is not publicly disclosed, the combination of widespread blocking and high detection rate strongly suggests recent deployment and active misuse across multiple campaigns. If you’ve visited this domain or entered any credentials, immediately change passwords on all affected accounts and enable multi-factor authentication where possible. Scan your device for malware using up-to-date antivirus software and monitor financial accounts for unusual activity. Report the incident to your security team or service provider if this domain was accessed through a corporate network. Do not re-enter any personal or login information on this site — it is confirmed malicious and should be treated as a compromised endpoint.