pub-9e2030303d9b43ffaedcde988f24645c[.]r2[.]dev

The domain pub-9e2030303d9b43ffaedcde988f24645c.r2.dev is assessed as part of a generic_phishing infrastructure. No legitimate brand association or drainer kit attribution is indicated in the available intelligence. The page title resolves to "Not Found", suggesting either content removal or inactive hosting, consistent with transient phishing deployment patterns using object storage endpoints.

Technical indicators show elevated malicious reputation. VirusTotal reports 19/95 security vendors flagging the domain as malicious. The domain is registered and served through Cloudflare R2 infrastructure, with SSL provided via Let's Encrypt (E7 certificate chain). The resolved IP address is 104.18.54.45, geolocated to CA under Cloudflare, Inc. hosting. The domain appears on 2 security blocklists, and the page title observed is "Not Found", indicating no active landing content at time of inspection. No Google Safe Browsing status data is provided in the available dataset.

At present, the domain status is offline, indicating possible takedown or deactivation of the phishing content. However, infrastructure reuse risk remains elevated due to the use of distributed storage hosting and CDN-backed IP masking. Even when inactive, such domains may be rapidly reactivated or replaced within the same hosting ecosystem. Given the 19/95 detection ratio and multi-source blocklist presence, the domain should be treated as high-risk historical phishing infrastructure. Recommended handling includes continued blocklisting of the host pattern, monitoring for sibling subdomain creation under the same R2 namespace, and enforcing network-level filtering to prevent reactivation-based delivery attempts.