pub-7d056bfeb6b04852801553620fe62c0a[.]r2[.]dev

PhishDestroy identifies pub-7d056bfeb6b04852801553620fe62c0a.r2.dev as a crypto drainer, a sophisticated phishing threat designed to trick users into connecting their cryptocurrency wallets and then drain their digital assets. Unlike generic credential theft, this domain specifically targets crypto holders by mimicking legitimate platforms or offering fake wallet connections. Once a user connects their wallet, malicious smart contracts are deployed to transfer funds without further authorization. The domain is currently offline, but its previous activity poses a significant risk to anyone who interacted with it.

Evidence against this domain is substantial. VirusTotal reports that 17 out of 95 security vendors flag it as malicious, indicating broad consensus among security tools. The domain was registered on April 15, 2026, through Cloudflare R2, a service often abused for its free tier and ease of setup. It resolves to IP 104.18.54.45 and appears on 2 security blocklists. The SSL certificate is issued by Let's Encrypt (E7), which is legitimate but frequently used by malicious sites due to its free and automated issuance. The page title was simply "Not Found," suggesting the site may have been quickly taken down after its malicious purpose was discovered.

If a user visited this domain, they should immediately revoke any permissions granted to the site, especially for cryptocurrency wallets. Check wallet approvals and use a revoke tool to remove any suspicious smart contract allowances. Run a full security scan on the device with reputable antivirus software. Monitor cryptocurrency accounts for unauthorized transactions and consider moving funds to a new wallet that has never interacted with the domain. Change passwords for any accounts where credentials might have been entered. Finally, report the domain to relevant authorities and blocklists to help protect others.