metis-ghostpic[.]vercel[.]app

This domain, metis-ghostpic.vercel.app, is actively engaged in credential harvesting targeting users of the Metis blockchain platform. Analysis of the page title, 'Ghost Pic | Metis,' and associated infrastructure indicates a fraudulent wallet interface designed to steal private keys or recovery phrases. The domain presents itself as an official Metis service, leveraging visual and branding elements to deceive users into entering sensitive information, which is then exfiltrated to attacker-controlled servers. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 216.198.79.67, hosted on Amazon Web Services (AS16509), and is registered through Vercel Inc. Google Safe Browsing has explicitly flagged the domain as phishing, while VirusTotal reports 12 out of 95 security vendors detecting malicious activity. Additionally, the domain appears on one security blocklist, and an SSL certificate issued by Google Trust Services (WR1) is present, which attackers commonly exploit to lend false legitimacy. No legitimate creation date or historical registration data is available, further suggesting a disposable, malicious infrastructure. Users who have visited metis-ghostpic.vercel.app or entered any credentials on the site should assume compromise. Immediate actions include revoking access to any connected wallets, transferring assets to a new secure wallet, and monitoring all linked accounts for unauthorized transactions. System scans using updated security tools are recommended to detect potential secondary payloads. If recovery phrases or private keys were exposed, consider all associated accounts permanently compromised. Users should report the incident to relevant blockchain security teams and avoid interacting with any communications claiming to be from Metis that reference this domain.