pub-f868e77df61146e2a31924f0f62189d5[.]r2[.]dev

PhishDestroy identifies pub-f868e77df61146e2a31924f0f62189d5.r2.dev as an active crypto-drainer domain currently under forensic investigation. The site impersonates legitimate cloud storage to deliver malicious JavaScript payloads that silently drain connected crypto wallets. No specific brand is mimicked in the domain itself, but the infrastructure mimics R2.dev branding to lower user suspicion and facilitate quick fund extraction. This domain resolves to IP 104.18.50.34 and is served over a Let’s Encrypt SSL certificate. VirusTotal shows 0/95 antivirus engines currently flagging the payload, indicating a zero-day or highly evasive threat. The domain is hosted on Cloudflare via the r2.dev subdomain namespace and was recently registered, though the exact creation date is not yet public. Google Safe Browsing (GSB) has not yet blacklisted the domain, and third-party threat intelligence shows no prior blocklist entries. Status remains active with ongoing analysis. Users should block the domain at DNS/network level and avoid clicking any links to r2.dev subdomains. Remaining risk is moderate due to low detection coverage and active payload delivery. Immediate caution is advised when handling crypto transactions or visiting cloud storage links.