com-metamask-en-us[.]pineapple[.]page

The domain com-metamask-en-us.pineapple.page is identified as a high-risk brand impersonation threat targeting the MetaMask brand. The domain is currently offline, indicating that the malicious activity has been disrupted or taken down. However, the infrastructure and methods used in this campaign warrant thorough analysis to understand the potential impact and to prevent future similar incidents.

Analysis indicates that the domain was flagged by 14 out of 95 security vendors on VirusTotal, suggesting a significant level of malicious intent. The domain was registered through Squarespace Domains II LLC, a common registrar for legitimate and potentially malicious websites. Infrastructure analysis reveals that the domain resolves to the IP address 216.150.16.65, which is located in the United States and is part of the AS16509 Amazon.com, Inc. network. The SSL certificate was issued by Let's Encrypt, a widely trusted certificate authority, which can lend a false sense of security to unsuspecting users. Google Safe Browsing has also flagged the domain as a phishing site, and it appears on one security blocklist. These indicators collectively suggest a sophisticated attempt to impersonate MetaMask and deceive users into providing sensitive information.

Given the current status of the domain being offline, security teams and users should remain vigilant for any resurfacing of this or similar domains. It is recommended to update security blocklists and ensure that endpoint protection systems are configured to recognize and block this domain. Users should be educated about the importance of verifying the authenticity of URLs, especially those purporting to be from trusted brands like MetaMask. Additionally, organizations should consider implementing multi-factor authentication (MFA) and other security measures to protect against the theft of credentials and other sensitive data.