pub-238f01dd643c42f082469a85feccfb1c[.]r2[.]dev

PhishDestroy has identified pub-238f01dd643c42f082469a85feccfb1c.r2.dev as a site used for credential theft. This domain likely hosts a fake login page or data entry form designed to steal usernames, passwords, and other sensitive information from unsuspecting users. The goal of this site is to impersonate a legitimate service or website to trick users into divulging their personal information.

This domain is currently listed on 4 security blocklists, indicating that multiple security organizations have independently identified it as a threat. While VirusTotal shows a low detection rate of 17/95, the presence on multiple blocklists suggests a consensus among security providers about the malicious nature of this domain. The site uses an SSL certificate issued by Let's Encrypt. The domain resolves to the IP address 104.18.50.34.

Users who have visited pub-238f01dd643c42f082469a85feccfb1c.r2.dev should immediately change their passwords for any accounts where they used the same credentials. They should also scan their devices for malware and be vigilant for any signs of identity theft, such as unauthorized transactions or suspicious emails. It is essential to enable two-factor authentication wherever possible to add an extra layer of security to online accounts.