pub-9664b5d95af7475c93287f6c0e6fef8c[.]r2[.]dev

PhishDestroy identifies pub-9664b5d95af7475c93287f6c0e6fef8c.r2.dev as an active crypto drainer designed to masquerade as trusted cloud storage infrastructure. This domain mimics R2.dev, Cloudflare’s object storage service, to deceive users into connecting wallets under false pretenses. The infrastructure leverages signed transactions through deceptive landing pages, prompting wallet approvals for unauthorized transfers. Open-source intelligence indicates the domain was weaponized almost immediately post-creation, with no legitimate services hosted under this resolver. This domain resolves to Cloudflare IP 104.18.54.45 and is secured by a Let’s Encrypt SSL certificate. Registered through Cloudflare Partner (unknown registrar), the domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating low but present detection. The infrastructure profile includes a fast-flux network linked to multiple drainer kits observed in the wild. Google Safe Browsing (GSB) has not yet blacklisted this domain, and no historical blocklist entries exist as of this analysis. The absence of brand trademark infringement flags suggests attackers are leveraging subdomain opacity to evade detection. Current status indicates active operation with no visible takedown measures. Users accessing this domain risk wallet compromise through malicious transaction signing prompts. Immediate blocking at DNS and endpoint levels is recommended. Subsequent actions should include submission to threat intelligence feeds and browser blocklists. Given the domain’s low-profile detection rate and lack of GSB coverage, remaining risk is elevated and expected to persist until infrastructure deactivation or blacklisting occurs.