pub-2850cd5d83b9406498615dc0f50afc0d[.]r2[.]dev

PhishDestroy identifies pub-2850cd5d83b9406498615dc0f50afc0d.r2.dev as a high-risk crypto drainer domain designed to steal cryptocurrency from unsuspecting users. This site poses an immediate financial threat by tricking visitors into connecting crypto wallets or entering private keys, allowing attackers to drain funds directly. The domain’s behavior aligns with known crypto drainer tactics, where victims are lured via fake giveaways, fraudulent investment opportunities, or impersonated services to authorize malicious transactions. This domain was flagged by 15 out of 95 VirusTotal security vendors, placed on 3 separate blocklists (PhishingArmy, PhishingDB, OISD), and resolves to IP address 104.18.50.34. The domain’s SSL certificate was issued by Let’s Encrypt, and it remains active despite widespread detection. Security reports indicate this domain is part of a larger infrastructure targeting cryptocurrency holders, with no legitimate use case identified. If you visited pub-2850cd5d83b9406498615dc0f50afc0d.r2.dev, immediately disconnect your wallet and revoke any unauthorized permissions. Do not enter private keys or approve transactions. Use a trusted tool like PhishDestroy to scan for associated malware or compromised accounts. Report the domain to your wallet provider or relevant authorities to prevent further abuse. Stay vigilant—crypto drainers evolve rapidly, and verification is critical before any interaction.