pub-f1e213d7f7cb4ce7ba1028767eebb8db[.]r2[.]dev

PhishDestroy identifies pub-f1e213d7f7cb4ce7ba1028767eebb8db.r2.dev as an active crypto drainer distribution point designed to siphon cryptocurrency from unsuspecting users. This domain functions as a malicious payload host, serving crypto drainer scripts that silently connect to victims' wallets upon interaction, enabling unauthorized transfers. Security telemetry shows this infrastructure is weaponized for real-time theft under the guise of legitimate services, with the domain explicitly crafted to mimic common frontend hosts used by cloud storage providers. The threat actor leverages stolen session cookies and wallet approvals to bypass authentication and initiate rogue transactions without additional prompts.

This domain is not just another phishing page—it is a verified malicious node in a wider cryptocurrency theft campaign. VirusTotal analysis confirms that 9 out of 95 security vendors have flagged this domain as malicious, while it additionally appears on three independent blocklists including OpenPhish, PhishingArmy, and OISD. The domain resolves to IP address 104.18.54.45 and utilizes a legitimate Let's Encrypt SSL certificate to maintain the appearance of authenticity. Despite its professional appearance, technical analysis reveals it was registered recently and is being actively used to distribute crypto drainer malware.

If you have interacted with this domain—especially by clicking links, downloading files, or connecting your wallet—take immediate action. Disconnect any affected wallets from the internet, revoke any suspicious approvals, and review transaction logs for unauthorized activity. Use tools like PhishDestroy to validate the domain's status and scan your system for wallet compromise. Clear browser caches, remove any related browser extensions, and consider rotating wallet addresses and private keys if exposure is suspected. Stay vigilant: crypto drainers often hide in plain sight, masquerading as tools or services within legitimate ecosystems.