Domain security and threat intelligence

pub-3c813de67a514e13807f67850811201b.r2.dev

Name: pub-3c813de67a514e13807f67850811201b.r2.dev — PhishDestroy evidence record
Published: 2026-10-28
License: https://creativecommons.org/licenses/by/4.0/

In short

On 2026-10-28, pub-3c813de67a514e13807f67850811201b.r2.dev served a page headed "Access your wallet with your Secret Recovery Phrase." The page states that MetaMask cannot recover your password and that the entered phrase will be used to validate ownership, restore the wallet and set a new password, with a "Learn more" link. A dropdown offers a 12-word phrase option, and a notice says the entire phrase can be pasted into any field.

“MetaMask”

Review the evidence

Registrar: Cloudflare
Resolved IP: 104.18.54.45Cloudflare, Inc. · CDN
First observed: Oct 28, 2026

PhishDestroy assessment Critical

100/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Nov 7, 2026 · 23:19 UTCHTTP probe

Risk signals

VirusTotal detections: 18/92

VirusTotal

18 / 92

engine detections · 2026-10-28

URLScan

Malicious

Page captures

open gallery

Analysis

Domain summary

PhishDestroy first recorded pub-3c813de67a514e13807f67850811201b.r2.dev on 2026-10-28. Stored VirusTotal result: 18/92 engines flagged. malicious: 17. suspicious: 1. Analysis time (as stored): 2026-10-28T00:59:54Z. Retrieved (as stored): 2026-10-28T21:42:06Z. Risk: critical (100/100). Registrar: Cloudflare. Status: Last known active. Hosting: Cloudflare, Inc. Do not enter credentials or connect a wallet.

Critical

Status: Last known active
VirusTotal: 18 / 92
Scam type (automated label): Impersonation
Hosting: 104.18.54.45Cloudflare, Inc. · CDN
Registrar: Cloudflare
Page captures: 8

Page captures Source results Registration record

Capture recorded with this analysis · URLScan · 2026-10-28T20:46:58Z
SHA-256: 4a09c339299248765423ddc57d361473424f57e5e2b2294c3a71ef1b5b884e64

PhishDestroy analysis, reviewed version2026-11-04 06:49:05 UTC

The form provides twelve numbered input fields, each paired with an eye-close visibility icon, arranged in four rows. Below them sits a light-blue "Confirm Secret Recovery Phrase" button. A language selector set to English appears at the top right, and several images (logo, confirm, icon) failed to load, showing broken-image placeholders. The page was captured on 2026-10-28.

Source evidenceVirusTotal 18 / 92 7 sources

VirusTotal

18 / 92 engine detections

Analysis: 2026-10-28T00:59:54Z · UTC (provider ISO timestamps)

Open report

VirusTotalOriginal source recordObserved: 2026-10-28 00:59:54 UTC14 fields

Observed: 2026-10-28T00:59:54Z · Retrieved: 2026-10-28T21:42:06Z

Vendor result counts

Timeout: 0
Harmless: 44
Malicious: 17
Suspicious: 1
Undetected: 30

Vendor labels

DNS8: suspicious
ESET: phishing
VIPRE: phishing
G-Data: phishing
Lionic: phishing
Sophos: phishing
CyRadar: phishing
Webroot: malicious
Emsisoft: phishing
Fortinet: phishing
Netcraft: malicious
Kaspersky: phishing
Seclookup: malicious
Gridinsoft: phishing
ADMINUSLabs: malicious
BitDefender: phishing
Chong Lua Dao: malicious
alphaMountain.ai: phishing

Reputation score

Registrar

CloudFlare, Inc.

Created

2022-08-23 14:38:38 UTC

Expires

2025-08-23 14:38:38 UTC

Updated

2025-03-28 02:43:41 UTC

First seen

2024-07-18 14:33:38 UTC

DNS records

TTL, seconds
300
Type
A
Value
104.18.54.45
TTL, seconds
300
Type
AAAA
Value
2606:4700:311b::6812:3222
TTL, seconds
300
Type
AAAA
Value
2606:4700:311b::6812:362d
TTL, seconds
300
Type
A
Value
104.18.50.34

DNS records observed

2026-10-28 01:05:12 UTC

JARM fingerprint

27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645f

Certificate

Subject alternative names: *.r2.dev
Issuer: Let's Encrypt / YE1
Serial: 693922d815b82d332ced4a8de492c3e84e2
SHA-256: bb31547877b8bfe0d0029d1c7a552880338500eb84d5a5ed60579b3f861f1cc9
Subject: *.r2.dev
Valid until: 2026-12-06 05:31:56 UTC
Valid from: 2026-09-07 05:31:57 UTC

Registration record

Registrar: CloudFlare, Inc.
Registrar IANA ID: 1910
Registrar URL: None
Registered: 2022-08-23 14:38:38 UTC
Updated: 2023-09-04 18:27:26 UTC
Expires: 2025-08-23 14:38:38 UTC
Status: clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited
clientdeleteprohibited
clienttransferprohibited
clientupdateprohibited
Nameservers: camilo.ns.cloudflare.com
raphaela.ns.cloudflare.com
DNSSEC: unsigned

Original source fields · JSON

Vendor result counts	{ "timeout": 0, "harmless": 44, "malicious": 17, "suspicious": 1, "undetected": 30 }
Vendor labels	{ "DNS8": "suspicious", "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "ADMINUSLabs": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing" }
Reputation	0
Tags	[ "hex", "dga" ]
Registrar	CloudFlare, Inc.
Created	2022-08-23T14:38:38Z
Expires	2025-08-23T14:38:38Z
Updated	2025-03-28T02:43:41Z
First seen	2024-07-18T14:33:38Z
DNS records	[ { "ttl": 300, "type": "A", "value": "104.18.54.45" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:311b::6812:3222" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:311b::6812:362d" }, { "ttl": 300, "type": "A", "value": "104.18.50.34" } ]
Dns at	2026-10-28T01:05:12Z
Jarm	27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645f
Certificate	{ "san": [ ".r2.dev" ], "issuer": "Let's Encrypt / YE1", "serial": "693922d815b82d332ced4a8de492c3e84e2", "sha256": "bb31547877b8bfe0d0029d1c7a552880338500eb84d5a5ed60579b3f861f1cc9", "subject": ".r2.dev", "valid_to": "2026-12-06T05:31:56Z", "valid_from": "2026-09-07T05:31:57Z" }
Registration record	{ "registrar": "CloudFlare, Inc.", "registrar_iana_id": "1910", "registrar_url": "None", "created": "2022-08-23T14:38:38Z", "updated": "2023-09-04T18:27:26Z", "expires": "2025-08-23T14:38:38Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "nameservers": [ "camilo.ns.cloudflare.com", "raphaela.ns.cloudflare.com" ], "dnssec": "unsigned" }

Separate collector summary

This is a separate stored result. Its counts, vendors and dates do not replace the provider observation above. A retrieval date is not an analysis date.

source: VirusTotal
scope: unknown
result_state: observed
numerator: 21
denominator: 92
malicious: null
suspicious: null
vendors: ["ADMINUSLabs","alphaMountain.ai","BitDefender","Chong Lua Dao","CyRadar","DNS8","ESET","Emsisoft","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","Lionic","Netcraft","Seclookup","SOCRadar","Sophos","URLQuery","VIPRE","Webroot"]
observed_at: 2026-10-30 00:02:54
checked_at: 2026-10-30 22:00:31
fetched_at: 2026-10-30 21:00:32
time_basis: as stored; legacy timezone not established

URLScan

Malicious

SHA-256 06f442e404876bd7ec69b4c63a15a5c180d73499598924752e048dad0113f0aa

2026-10-28 20:46 UTC

Open report

URLScanOriginal source recordObserved: 2026-10-28 20:46:58 UTC20 fields

Observed: 2026-10-28T20:46:58Z · Retrieved: 2026-10-28T21:41:51Z

Report ID

01a18443-ee74-74b3-bd1e-27cb355172d8

Final URL

https://pub-3c813de67a514e13807f67850811201b.r2.dev/index.html

HTTP response

200

Redirect type

https-only

Redirects

To
https://pub-3c813de67a514e13807f67850811201b.r2.dev/index.html
From
http://pub-3c813de67a514e13807f67850811201b.r2.dev/index.html
Status
307

IP address

104.18.50.34

Contacted domains

bestfilltype.netlify.app
fonts.gstatic.com
code.jquery.com
gtomitsuka.github.io
fonts.googleapis.com
cdnjs.cloudflare.com
ajax.googleapis.com

Contacted IP addresses

192.179.24.94
185.199.109.153
98.84.224.111
104.17.25.14
151.101.65.155
142.251.179.95
104.18.50.34

Autonomous systems (ASN)

15169
54113
14618
13335

Server countries

Document hash

aa87e79867ba69efc8421f4e636b1f67daba75060e3e9c9605f96dd0251da9db

JavaScript globals

$
jQuery
Popper
gibberish
eye4
word21Input
word24_23
word18_3
word12_6
wordSelect
word15_13
word24_25
word24_17
word21_16
word24_10
word15_1
word15_3
wordForm1
word24_21
word15_7
eye5
word18_11
word18_8
word24_13
word24_7
word21_20
word21_3
wordForm2
word21_6
word15_11
word18_7
word12_10
word12_5
word21_10
word24_2
word18_10
word24_5
errbox
word18_13
word24_15

TLS session and certificate

Subject alternative names: *.r2.dev
Cipher: AES_128_GCM
Issuer: YE1
Subject: *.r2.dev
Protocol: TLS 1.3
Valid until: 2026-12-06 05:31:56 UTC
Valid from: 2026-09-07 05:31:57 UTC

Domain age, days

805

Registered domain age, days

805

Certificate age, days

Certificate validity, days

Page requests

Provider verdicts

Engine verdict

Tags: urlscan-ml
urlscan-ml-60c5e22
Score: 99
Malicious: Yes

Overall verdict

Tags: phishing
Score: 100
Brands: genericemail
metamask
Malicious: Yes
Categories: phishing

URLScan verdict

Tags: phishing
Score: 100
Brands: Generic Email
Metamask
Malicious: Yes
Categories: phishing

HTTP headers

Server: cloudflare
Content-type: text/html

Original source fields · JSON

Uuid	01a18443-ee74-74b3-bd1e-27cb355172d8
Final url	https://pub-3c813de67a514e13807f67850811201b.r2.dev/index.html
Status	200
Redirected	https-only
Redirects	[ { "to": "https://pub-3c813de67a514e13807f67850811201b.r2.dev/index.html", "from": "http://pub-3c813de67a514e13807f67850811201b.r2.dev/index.html", "status": 307 } ]
Ip	104.18.50.34
Contacted domains	[ "bestfilltype.netlify.app", "fonts.gstatic.com", "code.jquery.com", "gtomitsuka.github.io", "fonts.googleapis.com", "cdnjs.cloudflare.com", "ajax.googleapis.com" ]
Contacted IP addresses	[ "192.179.24.94", "185.199.109.153", "98.84.224.111", "104.17.25.14", "151.101.65.155", "142.251.179.95", "104.18.50.34" ]
Asns	[ "15169", "54113", "14618", "13335" ]
Countries	[ "US" ]
Document hash	aa87e79867ba69efc8421f4e636b1f67daba75060e3e9c9605f96dd0251da9db
Globals	[ "$", "jQuery", "Popper", "gibberish", "eye4", "word21Input", "word24_23", "word18_3", "word12_6", "wordSelect", "word15_13", "word24_25", "word24_17", "word21_16", "word24_10", "word15_1", "word15_3", "wordForm1", "word24_21", "word15_7", "eye5", "word18_11", "word18_8", "word24_13", "word24_7", "word21_20", "word21_3", "wordForm2", "word21_6", "word15_11", "word18_7", "word12_10", "word12_5", "word21_10", "word24_2", "word18_10", "word24_5", "errbox", "word18_13", "word24_15" ]
Tls	{ "san": [ ".r2.dev" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": ".r2.dev", "protocol": "TLS 1.3", "valid_to": "2026-12-06T05:31:56Z", "valid_from": "2026-09-07T05:31:57Z" }
Domain age days	805
Apex age days	805
Tls age days	51
Tls valid days	89
Requests	19
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericemail", "metamask" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Email", "Metamask" ], "malicious": true, "categories": [ "phishing" ] } }
HTTP headers	{ "server": "cloudflare", "content-type": "text/html" }

Separate monitor record · 2026-10-29 04:30 UTC

Separate stored monitor snapshot; does not replace the primary report record or establish current availability.

record_source: domain_monitor.urlscan
uuid: 01a18443-ee74-74b3-bd1e-27cb355172d8
report_url: https://urlscan.io/result/01a18443-ee74-74b3-bd1e-27cb355172d8/
score: 100
malicious: true
result_at: 2026-10-29T04:30:31Z
enriched_at: 2026-10-29T09:15:41Z
source_timestamps: {"urlscan_result_at":"2026-10-29 05:30:31","urlscan_enriched_at":"2026-10-29 10:15:41"}
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

OTX

no community references

2026-10-28 23:11 UTC

Open report

Google Safe Browsing

No threat flag

2026-11-08 05:02 UTC

Open report

Spamhaus DBL

Check recorded; verdict not retained

2026-10-28 23:30 UTC

Open report

PhishDestroy DOM

25 / 100 · heuristic score · 1 brand reference · 1 classification

2026-10-28 23:20 UTC

Open report

Separate monitor score · 25 / 100 · 2026-10-28T23:20:20Z

This dated monitor analysis is separate from the primary PhishDestroy analysis above. A heuristic score is not a measured probability.

record_source: domain_monitor.dom_analysis
heuristic_score: 25
analyzed_at: 2026-10-28T23:20:20Z
source_timestamp: 2026-10-29 00:20:20
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

PhishDestroy narrative

Narrative generation metadata

2026-11-04 06:49 UTC

Open report

Title, description and generation record

The narrative generation date is separate from observation dates. These are the retained publication fields, not an additional independent detection.

ai_title: pub-3c813de67a514e13807f67850811201b.r2.dev: Secret Recovery Phrase wallet access form
ai_description: PhishDestroy records pub-3c813de67a514e13807f67850811201b.r2.dev showing a wallet access form requesting a 12-word Secret Recovery Phrase.
ai_summary: On 2026-10-28, pub-3c813de67a514e13807f67850811201b.r2.dev served a page headed "Access your wallet with your Secret Recovery Phrase." The page states that MetaMask cannot recover your password and that the entered phrase will be used to validate ownership, restore the wallet and set a new password, with a "Learn more" link. A dropdown offers a 12-word phrase option, and a notice says the entire phrase can be pasted into any field. The form provides twelve numbered input fields, each paired with an eye-close visibility icon, arranged in four rows. Below them sits a light-blue "Confirm Secret Recovery Phrase" button. A language selector set to English appears at the top right, and several images (logo, confirm, icon) failed to load, showing broken-image placeholders. The page was captured on 2026-10-28.
ai_generated_by: threat-v6-mimo
ai_generated_at: 2026-11-04 07:49:05
revision: 9b33bae699ec9c0027d1c9e0664907e92fe3d3d0d6d5a05c5e441d26b8a6e20d
mode: reviewed
interpretation: Selected public package; text generation time is separate from source observation dates.

Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.

Collected source details

Stored page, network and scanner observations, grouped by source and observation time.

Every stored field, with its source and date

Website checksOriginal source recordRetrieved: 2026-10-28 21:55:49 UTC16 fields

Mail configuration

SPF lookups: 0

CAA records

Count: 2
Domain: r2.dev
Allowed issuers: ;
letsencrypt.org

Protective DNS results

Resolvers checked: 12
Blocked by: CloudFlare Family
Blocking resolvers: 1

Web archive observations

Last observation: 2024-11-10 14:30:02 UTC
First observation: 2024-11-10 14:30:02 UTC
Recorded changes: 0
Archived days: 1
Average page size, bytes: 6295

TLS connection

ALPN: http/1.1
Cipher: TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Supported versions: TLSv1
TLSv1.1
TLSv1.2
TLSv1.3
Certificate authorized: Yes
Forward secrecy: Yes

Ports

Open ports: 80
443
8080

DNS servers

Nameservers

IP address
162.159.44.118
Host
camilo.ns.cloudflare.com
IP address
172.64.34.192
Host
raphaela.ns.cloudflare.com

DNS zone

r2.dev

Location

IP address: 2606:4700:311b::6812:3222
ASN: 13335
Organization: Cloudflare, Inc.
City: Montreal
Country: CA