pub-ad3d40c665754dd4ab89a028b6551b6b[.]r2[.]dev

This domain, pub-ad3d40c665754dd4ab89a028b6551b6b.r2.dev, is flagged as a high-risk credential theft operation targeting users through deceptive login interfaces. Analysis indicates the site is designed to harvest usernames, passwords, and other authentication credentials, likely for subsequent unauthorized access to accounts or financial exploitation. The threat type is specifically credential theft, not generic phishing, with infrastructure tailored to mimic legitimate authentication portals. Infrastructure analysis reveals the domain resolves to the IP address 104.18.50.34, a Cloudflare proxy endpoint commonly used to obfuscate malicious origins. VirusTotal detection data shows 6 out of 95 security vendors have flagged this domain as malicious, a notable indicator given the conservative nature of vendor detection thresholds. The domain is registered under Cloudflare’s R2 storage service, which provides anonymized hosting with minimal registration transparency. No historical creation date or registrar details are publicly available, further complicating attribution. Blocklist monitoring services have not yet widely adopted this domain, but the existing detections and proxy infrastructure align with known credential theft campaigns. Mitigation steps for users and organizations include immediate blocking of the domain and its resolving IP at the network perimeter. Endpoint protection systems should be updated to flag or quarantine any connections to pub-ad3d40c665754dd4ab89a028b6551b6b.r2.dev. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, prioritizing financial, email, and administrative accounts. Multi-factor authentication (MFA) should be enforced where available to mitigate the impact of stolen credentials. Security teams are advised to monitor for anomalous authentication attempts, particularly from the IP 104.18.50.34, and review logs for any prior connections to this domain.