metamask-clone-six[.]vercel[.]app

This domain, metamask-clone-six.vercel.app, is identified as a high-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. The site is designed to deceive users into believing they are interacting with the legitimate MetaMask platform, potentially leading to unauthorized access to wallet credentials, seed phrases, or direct cryptocurrency theft. Analysis indicates the site was structured to mimic MetaMask’s interface, likely prompting users to enter sensitive information under false pretenses. Such attacks are commonly referred to as crypto drainers, where malicious actors siphon funds from victims’ wallets once credentials are compromised. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, though this date may reflect a placeholder or misconfiguration, as it predates current detection timelines. The page currently returns a 404: NOT_FOUND status, suggesting it has been taken offline or altered post-detection. However, technical indicators confirm its malicious nature: Google Safe Browsing flags it as phishing, and it appears on at least one security blocklist. VirusTotal reports that 18 out of 95 security vendors detect the domain as malicious, with detections spanning categories such as phishing, brand impersonation, and crypto-related fraud. The domain’s hosting on Vercel, a legitimate platform, further complicates attribution, as attackers frequently abuse cloud services to evade detection and takedowns. Users who visited metamask-clone-six.vercel.app or interacted with its content should assume their credentials or wallet information may be compromised. Immediate steps include revoking any connected wallet sessions, generating new wallet addresses, and transferring remaining funds to a secure, unrelated wallet. Additionally, affected users should monitor their transaction history for unauthorized activity and enable multi-factor authentication on all crypto-related accounts. If sensitive information such as seed phrases or private keys was entered, the compromised wallet should be considered permanently at risk, and all associated assets should be moved to a new, secure wallet. Organizations and individuals are advised to update their security blocklists to include this domain and its associated indicators of compromise to prevent future exposure.