pub-b7fda1e0060f418199431736a36c9d53[.]r2[.]dev

PhishDestroy’s forensic analysis identifies pub-b7fda1e0060f418199431736a36c9d53.r2.dev as a high-risk crypto wallet login phishing domain. The infrastructure mimics legitimate cloud-storage subdomains to harvest wallet credentials and seed phrases, classifying the threat as a drainer-kit rather than generic phishing. No specific brand is spoofed, but the landing page replicates common wallet-login UIs to deceive users into surrendering private keys. Creation appears automated, leveraging a randomized prefix to evade simple detection rules.

Technical indicators confirm hostile intent: VirusTotal records 20/95 security vendors flagging the domain, while public blocklists from OpenPhish, PhishingArmy, and OISD already block access. The domain resolves to IPv4 address 104.18.54.45 and is secured by a Let’s Encrypt SSL certificate. The registrar remains unconfirmed, but the domain’s age suggests recent registration aimed at short-lived campaigns. Google Safe Browsing has not yet marked the domain as malicious, leaving a window for continued exploitation.

The domain remains active as of this report, with active takedown requests submitted to the hosting provider and registrar. Despite these actions, the risk level stays high due to the drainer kit’s ability to exfiltrate cryptocurrency in real time. Users are strongly advised to verify wallet URLs via official channels, enable hardware wallet authentication, and immediately revoke any exposed seed phrases. Continuous monitoring shows the domain continues to resolve, indicating an unresolved threat requiring urgent user vigilance.