pub-e1e4d0b4665d4d8996bf04516d898fb2[.]r2[.]dev

The domain pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev has been identified as a threat due to brand impersonation activities targeting MetaMask. This domain is currently offline, reducing immediate risk, but the threat level remains elevated due to its past activities. The domain's page title was found to be 'MetaMask', indicating a deliberate attempt to deceive users into believing they are interacting with the legitimate MetaMask service.

This domain was flagged by 19 out of 95 security vendors on VirusTotal, indicating a significant consensus on its malicious intent. It was registered through Cloudflare R2 and resolved to the IP address 2606:4700:3113::6812:362d, which is located in the United States under AS13335 Cloudflare, Inc. The domain appeared on two security blocklists, including PhishDestroy and PhishingDB, which further underscores its malicious nature.

Currently, the domain is offline, which mitigates the immediate risk of phishing attacks. However, it is crucial for users to remain vigilant and ensure that they are accessing the legitimate MetaMask site. It is recommended to utilize security solutions that can detect and block such domains, and to frequently check for updates from trusted security vendors to protect against future threats. Additionally, organizations should consider educating their users about the dangers of phishing and brand impersonation scams.