pub-4dc48d557b86459e9b38d7fc711db3f6[.]r2[.]dev

This domain, pub-4dc48d557b86459e9b38d7fc711db3f6.r2.dev, is flagged as a credential harvesting phishing site designed to steal login credentials, payment details, or other sensitive information. Such sites often mimic legitimate services or use social engineering tactics to trick users into submitting personal data. While currently offline, this domain previously resolved to infrastructure commonly exploited for phishing campaigns, posing a risk to users who may have interacted with it before detection. Analysis indicates the domain was registered on May 19, 2026, through Cloudflare R2, an unusual creation date suggesting potential domain spoofing or backdating. It resolved to the IP address 104.18.50.34 and was detected by 2 out of 95 security vendors on VirusTotal. Additional indicators include its presence on one security blocklist, a Gridinsoft trust score of 0/100, and the use of Let's Encrypt SSL certificates, which are frequently leveraged by threat actors to appear legitimate. The domain also employed HSTS and Cloudflare technologies, which can obscure malicious activity behind legitimate infrastructure. If you visited pub-4dc48d557b86459e9b38d7fc711db3f6.r2.dev or entered any information on the site, take immediate action. Disconnect the device from the internet to prevent potential data exfiltration. Run a full scan using updated security software to detect any malware or unauthorized access. Change passwords for any accounts accessed while the device was connected to the site, prioritizing financial, email, and work-related credentials. Enable multi-factor authentication where possible to add an extra layer of security. Monitor accounts for unusual activity and report any suspicious transactions or login attempts to the relevant service providers.