metamask-docs-git-dependabot-npmandya-95394d-consensys-ddffed67[.]vercel[.]app

The domain metamask-docs-git-dependabot-npmandya-95394d-consensys-ddffed67.vercel.app is flagged as an active, high‑risk brand‑impersonation site targeting MetaMask. It was registered on May 12, 2026 and resolves to IP 64.29.17.131, a Vercel‑hosted server located in the United States. The site serves HTTPS using a Google Trust Services certificate (WR1) and returns HTTP 200. The page title observed is "Home | MetaMask developer documentation," matching the advertised brand. Reputation data shows a Gridinsoft trust score of 0/100, and the domain appears on three security blocklists. It has been blocked by PhishDestroy, MetaMask, and SEAL, and VirusTotal records indicate that 19 of 92 scanners flag the domain. Infrastructure analysis confirms the Vercel hosting and the IP location, but no deeper content inspection is available; the exact phishing payload or credential‑capture mechanisms have not been disclosed. Defenders should immediately add the domain to deny‑lists, monitor outbound DNS queries for the associated IP, and alert end‑users to avoid any credential entry on sites presenting MetaMask branding. Continuous re‑scanning is recommended to detect any changes in payload or hosting configuration.