pub-d71709b11f304e0b87fe3275219dc568[.]r2[.]dev

Domain pub-d71709b11f304e0b87fe3275219dc568.r2.dev has been confirmed as an active crypto drainer site engaged in malicious activities. This domain poses a high-risk threat to users, particularly those involved in cryptocurrency transactions, as it is designed to siphon funds from unsuspecting victims. The site is currently active and should be treated as a critical security concern.

This domain resolves to IP address 104.18.54.45 and is associated with a Let’s Encrypt SSL certificate, which may be leveraged to establish false trust. PhishDestroy’s analysis reveals that 17 out of 95 VirusTotal security vendors have flagged this domain, highlighting its malicious nature. Additionally, it has been blocked by multiple reputable blocklists, including OpenPhish, PhishingArmy, and OISD, totaling three separate detections. The domain’s infrastructure is hosted on Cloudflare’s R2 storage service, which may be exploited to evade traditional security measures.

Given the active status of this crypto drainer and its widespread detection across security platforms, immediate action is required to mitigate potential risks. Organizations and individuals are strongly advised to block this domain at the network level and update firewall rules to prevent access. Users should exercise heightened caution when engaging with unknown domains, especially those involving cryptocurrency transactions. It is also recommended to scan endpoints for signs of compromise and to report this domain to internal security teams or threat intelligence platforms for further analysis.