pub-255c8366ca004ed1afec6034c07be75f[.]r2[.]dev

The domain pub-255c8366ca004ed1afec6034c07be75f.r2.dev is an active generic phishing site posing an elevated risk of credential theft or malware distribution. It does not impersonate a specific brand or deploy a known crypto drainer kit. As of the latest assessment, the site remains operational and continues to serve content indicative of phishing activity.

Technical indicators confirm the domain pub-255c8366ca004ed1afec6034c07be75f.r2.dev is flagged by 2 of 95 VirusTotal security vendors, including alphaMountain.ai and Webroot. It appears on 1 security blocklist (PhishDestroy) but is not currently flagged by Google Safe Browsing. The domain was registered through Cloudflare, Inc. on February 21, 2026, and is hosted on Cloudflare’s infrastructure. Observed technologies include HSTS and Cloudflare, with the page returning an HTTP 403 status and a title reading 'Suspected phishing site | Cloudflare'. No IP address or SSL issuer details are available.

Users who may have interacted with pub-255c8366ca004ed1afec6034c07be75f.r2.dev should immediately change any exposed credentials, enable two-factor authentication on affected accounts, and monitor for unauthorized access or fraudulent transactions. Report the domain to your organization’s security team or use platforms like PhishTank, Google Safe Browsing, or local cybercrime units to aid in takedown efforts. Avoid further interaction with the site to prevent additional exposure.