metamask-docs-39ctk6lw2-consensys-ddffed67[.]vercel[.]app

The domain metamask-docs-39ctk6lw2-consensys-ddffed67.vercel.app was registered on May 29, 2026 and resolves to IP 64.29.17.195, an Amazon.com, Inc. (AS16509) host located in the United States. The site serves an HTTP 200 response and presents the page title "MetaMask Developer Documentation - Build Web3 Apps | MetaMask," directly referencing the MetaMask brand. Infrastructure analysis shows the site is hosted on Vercel and employs Docusaurus, React, Osano, Linkedin Insight Tag, HubSpot Analytics, HSTS, and Google Tag Manager, matching the technology stack of legitimate MetaMask developer pages. The SSL certificate is issued by Google Trust Services / WR1, indicating a valid TLS chain. VirusTotal reports 16 of 91 security vendors flag the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on three security blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL. The threat type is identified as brand impersonation, targeting MetaMask users seeking developer documentation. While the page content has not been manually inspected, the combination of brand‑specific title, legitimate‑looking technology stack, and multiple vendor detections suggests a high‑risk impersonation campaign. Defenders should add the domain to network and endpoint blocklists, monitor DNS queries for the host, and enforce strict referer validation for MetaMask documentation resources. Further analysis of the page payload is recommended to confirm any credential‑harvesting or malicious script activity.