pub-9b2d32be22f64fa1b6e01a709c470928[.]r2[.]dev

This domain, pub-9b2d32be22f64fa1b6e01a709c470928.r2.dev, was flagged by PhishDestroy as a generic phishing threat. That means it could be part of a credential theft, brand impersonation, or crypto drainer scheme—though the exact intention is still unclear. The site is currently offline, but that doesn't mean it's safe; attackers often rotate domains or reactivate them later.

The evidence comes from several sources. The domain resolves to IP 104.18.50.34, which is associated with Cloudflare. It was created on May 19, 2026, and registered through Cloudflare R2. The SSL certificate is from Let's Encrypt (E8). VirusTotal shows 0 detections out of 95 engines, meaning it hasn't been widely flagged yet—but it does appear on one security blocklist. This early stage of investigation is why the risk level is set to 'under investigation' and the status is 'offline.'

If you visited this domain, you should take action. Change any passwords you may have entered, enable two-factor authentication on your accounts, and monitor for unusual activity. Run a full antivirus scan on your device. Consider reporting the domain to your email provider or security team. Stay cautious—even if a site looks legitimate, always verify the URL before entering sensitive information.