pub-35312b95baf4482f8dd1d6c35e6943a1[.]r2[.]dev

This domain is flagged as a brand impersonation site designed to mimic MetaMask, a widely used cryptocurrency wallet. The threat posed involves crypto drainer tactics, where attackers trick users into connecting their wallets to malicious smart contracts, resulting in unauthorized fund transfers. Victims may unknowingly sign transactions that empty their wallets under the guise of legitimate MetaMask interactions. The site's infrastructure and content are engineered to exploit trust in the MetaMask brand, making it particularly dangerous for users unfamiliar with phishing indicators. Analysis indicates the domain is hosted on Cloudflare R2 infrastructure and resolves to the IP address 104.18.50.34, associated with Cloudflare, Inc. in the United States. It is currently offline but was previously flagged by 17 out of 95 security vendors on VirusTotal, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain appears on two security blocklists, and its page title explicitly uses the MetaMask name, a clear indicator of brand impersonation. No legitimate creation date or registrar details are available, further suggesting its fraudulent nature. If you visited this domain or interacted with its content, immediately disconnect any connected wallets and revoke permissions for suspicious smart contracts. Check your wallet transaction history for unauthorized activity and transfer remaining funds to a new, secure wallet. Enable multi-factor authentication on all accounts and monitor for unusual login attempts. Report the domain to your wallet provider and relevant security platforms to help prevent further incidents. Always verify domain authenticity by cross-referencing official sources before entering sensitive information or connecting wallets.