pub-40ea7438bede4d77bad8f6c9675b1885[.]r2[.]dev

This domain, pub-40ea7438bede4d77bad8f6c9675b1885.r2.dev, is identified as a generic phishing resource with an elevated risk classification. Analysis indicates it operates as a cryptocurrency phishing site, likely designed to harvest wallet credentials or distribute fraudulent token claims. No specific brand impersonation or drainer kit signatures have been confirmed, though the infrastructure aligns with common phishing toolchains observed in prior campaigns targeting decentralized finance platforms. Infrastructure analysis reveals the domain resolves to the IP address 104.18.54.45, hosted under Cloudflare, Inc. in Canada. It was registered through Cloudflare R2 on April 03, 2026, a future date suggesting potential data entry anomalies or obfuscation techniques. Detection metrics show 17 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on two independent security blocklists. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or intermittent inclusion. The domain is currently offline, likely following takedown actions or voluntary suspension by the registrar. Despite its inactive status, residual risk persists for users who may have interacted with the site during its operational window. Organizations are advised to monitor network logs for connections to 104.18.54.45 and the domain itself, while end-users should verify wallet integrity and revoke any suspicious token approvals associated with this infrastructure. Proactive blocking of the domain and IP at perimeter security controls is recommended to prevent potential re-emergence.