pub-b03a69ad30ee4739a0deca2eabea959e[.]r2[.]dev

The domain pub-b03a69ad30ee4739a0deca2eabea959e.r2.dev has been identified as a generic phishing threat, currently offline. No specific brand or drainer kit was associated with this domain during analysis. It appears to have been set up for malicious purposes, likely targeting unsuspecting users through deceptive tactics.

Technical indicators reveal that the domain resolves to IP address 104.18.50.34 and is registered through Cloudflare R2. It has an SSL certificate issued by Let's Encrypt (E7). VirusTotal data shows that 17 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. The domain was taken offline before PhishDestroy could analyze its full behavior, but its presence on blocklists and vendor flags indicates significant risk.

As the domain is currently offline, the immediate threat is neutralized. However, users should remain cautious of similar domains hosted on Cloudflare R2 or using Let's Encrypt certificates, as these are common among phishing campaigns. PhishDestroy recommends monitoring for any re-registration or similar domains and avoiding interaction with any suspicious links or downloads from unknown sources.