pub-8c1c14c3b0d64d0099312bb4670f2e23[.]r2[.]dev

This domain, pub-8c1c14c3b0d64d0099312bb4670f2e23.r2.dev, is flagged for elevated-risk brand impersonation, specifically targeting users through a fraudulent MetaMask-themed interface designed to harvest email credentials. The threat type aligns with generic email credential theft, a common tactic in phishing campaigns where attackers mimic legitimate services to deceive victims into disclosing sensitive information. Analysis indicates the domain was operational until recently taken offline, suggesting prior active exploitation in malicious campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare R2, resolving to the IP address 104.18.54.45, which is associated with AS13335 (Cloudflare, Inc.) and geolocated in the United States. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains due to its free and automated issuance process. No historical WHOIS data or creation date is provided, but the combination of blocklist presence, vendor detections, and impersonation of a cryptocurrency wallet service underscores its malicious intent. Mitigation steps for this threat type include immediate blacklisting of the domain and its associated IP address (104.18.54.45) across all network security controls, including firewalls, email gateways, and endpoint protection systems. Organizations should conduct retrospective log analysis to identify any prior interactions with the domain or IP, particularly focusing on email and web traffic. User awareness training should emphasize the risks of credential harvesting through brand impersonation, with specific guidance on verifying domain authenticity and avoiding unsolicited requests for sensitive information. Additionally, monitoring for similar domains leveraging Cloudflare R2 infrastructure or MetaMask-themed lures can help preemptively block related threats.