metamask-auth-with-moralis[.]vercel[.]app

Analysis indicates metamask-auth-with-moralis.vercel.app is a high-risk brand impersonation domain configured to mimic a wallet authentication workflow and solicit sensitive user input. The infrastructure and naming pattern are consistent with credential and wallet-access theft, with the domain presenting itself as a legitimate connection or verification page while attempting to harvest authentication data.

Evidence supports active malicious classification. The domain remains active and is hosted through Vercel Inc., resolving to IP 64.29.17.3 in US infrastructure associated with AS16509 Amazon.com, Inc. VirusTotal reports 4/95 vendor detections for the domain, and it appears on 1 security blocklist. Blocking telemetry shows it has already been flagged by PhishDestroy. TLS delivery is enabled through a certificate issued by Google Trust Services / WR1, which can make the page appear more trustworthy to end users despite the underlying risk.

If a user visited this domain, any credentials, seed phrases, wallet approvals, or authentication tokens entered there should be treated as compromised. Immediate remediation should include changing related account credentials, revoking active sessions and wallet approvals, and moving exposed digital assets to a clean wallet if applicable. Systems used to access the page should be scanned for additional malicious content, and affected users should monitor accounts for unauthorized sign-ins or transactions. Network and mail filtering teams should maintain blocking coverage while the domain remains active.