pub-135a4055f8454025aa2f06845da4f8d8[.]r2[.]dev

PhishDestroy identifies pub-135a4055f8454025aa2f06845da4f8d8.r2.dev as a high-risk fake-login phishing site currently active on the internet. This domain is engineered to mimic a legitimate online service and steal user credentials the moment they are entered. It has already been detected by multiple automated crawlers and is now blocked by OpenPhish, PhishingArmy, and OISD, showing strong consensus that this infrastructure is actively used in credential-harvesting campaigns. The domain resolves to IP address 104.18.54.45 and is secured with a Let’s Encrypt SSL certificate, giving it a false appearance of legitimacy to unwary visitors. PhishDestroy’s analysis confirms that pub-135a4055f8454025aa2f06845da4f8d8.r2.dev first appeared on security blocklists on seed ba19de and is now flagged by 17 out of 95 VirusTotal partners. This detection ratio indicates a high-confidence threat rather than a borderline case. The domain is served from Cloudflare R2 storage, a legitimate cloud service that is being abused to host the phishing payload. Security telemetry shows that this infrastructure is part of a broader campaign aimed at harvesting user login details for financial services, social platforms, and corporate portals. If you have visited pub-135a4055f8454025aa2f06845da4f8d8.r2.dev or entered any credentials, assume they have been compromised. Immediately change passwords on all related accounts and enable multi-factor authentication where available. Scan your device with updated antivirus software and review recent transaction histories for signs of fraud. Report the domain to PhishDestroy for takedown and warn colleagues or family members who may have been exposed. Staying vigilant and verifying links before clicking remains the best defense against credential theft.