pub-11e6504d5d9a40ff97bcd3d5ee476ec8[.]r2[.]dev

PhishDestroy identifies pub-11e6504d5d9a40ff97bcd3d5ee476ec8.r2.dev as an active crypto drainer phishing domain posing extreme risk to cryptocurrency users. This domain employs sophisticated social engineering tactics to trick victims into connecting cryptocurrency wallets and initiating unauthorized transfers. The infrastructure is designed to drain digital assets within minutes of wallet connection, making it particularly dangerous for DeFi users and NFT collectors. Security researchers classify this as a high-risk threat due to its high conversion rate and ability to bypass traditional security measures. This domain was flagged by 17 out of 95 VirusTotal security vendors, placing it in the top 1% of malicious domains. The domain resolves to IP address 104.18.54.45, which is associated with Cloudflare's R2 storage service. The SSL certificate was issued by Let's Encrypt, indicating the threat actors are using valid encryption to appear legitimate. This domain appears on three major blocklists including OpenPhish, PhishingArmy, and OISD, confirming its malicious status. The domain uses Cloudflare's infrastructure to evade detection and maintain availability, while the r2.dev subdomain indicates it's hosted on Cloudflare R2 storage, a legitimate service being abused for malicious purposes. To mitigate this crypto drainer threat, immediately block the domain pub-11e6504d5d9a40ff97bcd3d5ee476ec8.r2.dev at your network perimeter using DNS filtering or firewall rules. Cryptocurrency users should verify all wallet connection requests through out-of-band communication channels and never approve transactions from unknown sources. Implement wallet connection monitoring tools that alert users to suspicious contract interactions. Organizations should update their threat intelligence feeds with this IOC and consider deploying browser isolation technologies for cryptocurrency-related activities. The combination of valid SSL certificates and major cloud hosting services makes this threat particularly challenging to detect, requiring layered security approaches that combine network-level blocking with user education and advanced endpoint protection.