MetaMask 'Secret Recovery Phrase' restore-wallet phishing kit on Cloudflare R2 public buckets

One hunt for the kit. A match is a page that loads one of the kit's asset hosts (bestfilltype.netlify[.]app, optimist-fashiongroup[.]ru, vitsbooksshopmain.netlify[.]app), has the screenshot of the kit's restore screen, shows the sentence 'MetaMask cannot recover your password' on screen, or is a known copy whose layout differs (pub-dc5e2b185ea941fca482351935a0f3be.r2[.]dev). The collection endpoints are named in the page script and are contacted only when a victim submits, so they are listed here for blocking rather than matched: PHP scripts on free-DNS subdomains of publicvm[.]com (for example kandhsiahfh, boinertunexoi, freuserndb, nziwhrbsjd, sol15, adsol16, shshdjdhakfoabg, thekingobaluayeconfirm, benerzxrtom, benerzxrtoc, bexernoajind, gajakdbdiebsk), and a handful of other hosts, some of which look like compromised third-party sites. The many collection hosts and the naming of the publicvm subdomains suggest one operator, but that is an assessment. Not included: other MetaMask-themed lures on R2 that use a different page (for example a fake 'Checking your browser' captcha), and a German translation of this kit that loads its images from elsewhere.