pub-f116f875e0aa4d7cb9e2ecfa533098af[.]r2[.]dev

The domain pub-f116f875e0aa4d7cb9e2ecfa533098af.r2.dev has been confirmed as a crypto drainer phishing endpoint, designed to illicitly extract cryptocurrency assets from victims through deceptive transaction prompts. Analysis indicates the site operated as a high-risk threat, specifically targeting users of decentralized finance platforms by impersonating legitimate wallet interfaces. At the time of assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered through Cloudflare R2 on April 01, 2026, and resolved to the IP address 104.18.54.45. The site employed a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy to malicious endpoints. Detection metrics further substantiate the threat classification: the domain was flagged by 15 of 95 security vendors on VirusTotal and appeared on 5 distinct security blocklists, including entries from MetaMask, PhishDestroy, SEAL, PhishingDB, and OISD. These indicators collectively underscore the domain's malicious intent and widespread recognition as a phishing vector. Current status confirms the domain is offline, mitigating immediate risk to end users. However, the infrastructure and registration details suggest potential for re-emergence under similar or altered identifiers. Organizations and individuals are advised to maintain updated blocklists incorporating this domain and monitor for related indicators of compromise. Users who interacted with the endpoint should immediately revoke any connected wallet permissions, transfer assets to a secure address, and conduct a thorough audit of transaction histories for unauthorized activity. Proactive measures, including the deployment of real-time phishing detection mechanisms, are recommended to prevent exposure to analogous threats.