pub-98040ea363724ccebacba31c3ad69f60[.]r2[.]dev

PhishDestroy identifies pub-98040ea363724ccebacba31c3ad69f60.r2.dev as an active credential harvesting end point. The domain is weaponized to trick users into surrendering login credentials under false pretenses, often impersonating legitimate services such as cloud storage or document-sharing platforms. Once harvested, credentials are exfiltrated to attacker-controlled infrastructure for subsequent account takeover and data theft campaigns. Security telemetry shows this host resolving to 104.18.50.34 via Cloudflare, with a Let’s Encrypt certificate in place to enhance believability. This domain was flagged by PhishingArmy and OISD and appears on two independent blocklists, indicating widespread consensus on its malicious nature. VirusTotal analysis shows 17 out of 95 participating security vendors have already labeled the domain as malicious, underscoring elevated risk to visitors. The infrastructure footprint is consistent with opportunistic phishing operations, where low-cost automation and rapid domain rotation obscure the true scale of compromise. If you visited or entered any information on pub-98040ea363724ccebacba31c3ad69f60.r2.dev, immediately change passwords for any accounts you may have exposed and enable multi-factor authentication wherever possible. Run a full antivirus scan on the device used to access the site. Report the domain to your organization’s security team or to PhishDestroy’s public portal to aid collective defense. Avoid re-visiting the link and treat any local credentials as potentially compromised until verified safe.