pub-d69c77ba755745888f5f3bae287f77ec[.]r2[.]dev

This domain, pub-d69c77ba755745888f5f3bae287f77ec.r2.dev, poses a direct threat as a MetaMask wallet phishing site designed to harvest cryptocurrency credentials and private keys. Analysis indicates the site mimics legitimate MetaMask interfaces, tricking users into entering sensitive wallet information under the false pretense of account verification or security updates. The page title explicitly displays 'MetaMask,' a clear indicator of brand impersonation targeting cryptocurrency users who may unknowingly disclose their recovery phrases or passwords. Infrastructure analysis reveals concrete evidence of malicious intent. The domain is hosted on Cloudflare R2, a storage service often exploited for phishing due to its low-cost, high-availability nature. It resolves to the IPv6 address 2606:4700:3117::6812:3222, associated with Cloudflare’s AS13335, and uses a Let's Encrypt SSL certificate (serial number prefix E7) to create a false sense of security. The domain appears on two security blocklists and is flagged by 18 out of 95 security vendors on VirusTotal, including detections for credential theft and brand impersonation. No legitimate registration details or creation date are publicly available, further suggesting its use for short-term malicious campaigns. Users who visited this domain should take immediate action to mitigate risk. First, disconnect any active sessions and revoke access to any connected cryptocurrency wallets or browser extensions. Change passwords and recovery phrases for all crypto-related accounts, especially MetaMask, and enable multi-factor authentication where possible. Monitor linked accounts for unauthorized transactions and report the incident to relevant platforms or security teams. If sensitive data was entered, consider migrating funds to a new wallet address to prevent potential theft. This domain has been taken offline, but similar threats may emerge; always verify URLs and SSL certificates before interacting with cryptocurrency services.