pub-d37b8cff4381478390372f45fa529228[.]r2[.]dev

The domain pub-d37b8cff4381478390372f45fa529228.r2.dev is currently classified as a generic phishing site with a high risk rating. Infrastructure analysis shows the domain is hosted behind Cloudflare, Inc., and resolves to the IPv4 address 104.18.54.45. No authoritative name server records are returned (NS_NOT_FOUND), indicating that standard DNS enumeration did not retrieve NS data. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that at least one defensive product has taken protective action.

VirusTotal scans reveal that 13 of 91 security vendors have flagged the domain, providing independent corroboration of malicious intent. The domain’s registration via Cloudflare suggests the use of a privacy‑preserving registrar, which can hinder attribution efforts. The current operational status is listed as active, meaning the malicious payload or phishing page is still reachable.

Defenders should continue to block the domain at perimeter filters, update DNS sinkhole entries, and monitor outbound traffic for connections to 104.18.54.45. Because the domain’s content has not been publicly analyzed, the specific phishing lure and targeted brand remain unknown; threat hunters should prioritize sandboxing any retrieved page content to extract page titles, credential‑capture forms, or additional C2 infrastructure. Ongoing vigilance is required, as the domain may be leveraged in broader campaigns that reuse the same hosting IP or Cloudflare account.