welcome-metamask-cdn[.]pineapple[.]page

The domain welcome-metamask-cdn.pineapple.page was identified as a brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. Analysis confirms the domain was designed to deceive users into believing they were interacting with an official MetaMask support or account management portal, as evidenced by the page title 'Accounts | MetaMask Help Center.' The domain is currently offline, though prior activity indicates a deliberate attempt to harvest sensitive credentials or facilitate unauthorized transactions. Infrastructure analysis reveals the domain resolved to the IP address 216.150.16.129, hosted within the United States under Amazon.com, Inc. (AS16509). The domain was registered through Squarespace Domains II LLC and secured with a Let's Encrypt SSL certificate (R13). Detection metrics indicate the domain was flagged by 12 of 95 security vendors on VirusTotal, while only a single blocklist, PhishDestroy, had previously listed it. The limited blocklist presence suggests either a short operational window or evasion techniques employed to delay widespread detection. Given the elevated risk associated with cryptocurrency-related fraud, organizations and end users are advised to treat this domain as malicious. Although currently offline, historical resolution data and SSL certificate details should be incorporated into network security controls to prevent future access attempts. Users who may have interacted with the domain should immediately revoke any active sessions, rotate credentials, and monitor associated wallet addresses for unauthorized activity. Security teams are encouraged to review logs for connections to 216.150.16.129 and the domain itself to assess potential exposure.