auth-mask-x-auth[.]pineapple[.]page

On July 23, 2026, the domain auth-mask-x-auth.pineapple.page was identified as a high-risk brand impersonation threat targeting MetaMask. This domain impersonates MetaMask and claims to be a login page for Canada’s Most Secure Crypto Exchange. Infrastructure analysis reveals that the domain is registered through Vercel Inc. and resolves to an IP address (216.150.16.65) located in the United States, under the control of Amazon.com, Inc. (ASN16509). The domain is protected with an SSL certificate issued by Let's Encrypt, indicating efforts to appear legitimate.

However, the Gridinsoft trust score for this domain is extremely low at 0/100, signaling a high likelihood of malicious intent. Google Safe Browsing has flagged this domain for social engineering, suggesting that it may be used to deceive users into divulging sensitive information. Additionally, 14 out of 95 security vendors on VirusTotal have flagged this domain, and it appears on one security blocklist. The HTTP status of the domain is 200, meaning the site is accessible and operational.

Technologies detected on the site include Vercel, React, and HSTS, further suggesting a sophisticated setup designed to mimic a legitimate service. Given the current status of the domain as active and the flagging by multiple security platforms, defenders should take immediate action to block this domain, warn users, and monitor for any unauthorized access attempts. The exact content of the website has not yet been analyzed, but the page title and flagged status indicate a high-risk crypto scam operation.