pub-e7b64c658d8647888de66296dd65df4a[.]r2[.]dev

PhishDestroy identifies pub-e7b64c658d8647888de66296dd65df4a.r2.dev as an active generic phishing domain impersonating a login portal to harvest credentials and crypto wallet access. The domain remains live and poses an elevated risk to users who interact with its malicious content. Security teams should treat this as a high-priority threat due to its confirmed malicious activity across multiple detection platforms.

This domain resolves to IP address 104.18.50.34 and is currently flagged by 17 of 95 VirusTotal security vendors. It appears on 2 active security blocklists including PhishingArmy and OISD. The domain uses a valid Let’s Encrypt SSL certificate and is associated with a unique seed identifier a81afc for tracking purposes. As of current telemetry, the domain is active and has not been taken offline.

Users and organizations are strongly advised to avoid interacting with this domain. PhishDestroy recommends blocking all traffic to pub-e7b64c658d8647888de66296dd65df4a.r2.dev and investigating any systems that may have accessed it. Security teams should cross-reference internal telemetry with the provided IP and domain indicators. Additionally, users should enable wallet address verification and multi-factor authentication on all financial and identity systems as precautionary measures.