metamask-dev-dashboard-feat-remove-prora-consensys-ddffed67[.]vercel[.]app

This domain impersonates the MetaMask Developer dashboard interface to harvest cryptocurrency wallet credentials and sensitive user information. The page presents a fraudulent login portal titled 'Login | MetaMask Developer,' designed to deceive users into entering their wallet recovery phrases, private keys, or passwords. Analysis indicates the domain specifically targets developers and users familiar with MetaMask's legitimate development tools, increasing the likelihood of successful credential compromise due to perceived authenticity. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure and resolves to IP address 216.198.79.67 within Amazon.com, Inc.'s AS16509 network. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WR1), providing a false sense of security to potential victims. While the exact creation date remains unverified, the domain's active status and recent detection patterns suggest it was recently deployed for malicious purposes. Users who have visited this domain or entered credentials should immediately revoke access to any connected MetaMask wallets and create new wallets with fresh recovery phrases. All potentially compromised devices should undergo malware scans to detect any installed credential-stealing software. Users should verify all connected dApps and revoke permissions through MetaMask's legitimate interface. Any cryptocurrency transactions initiated after visiting this domain should be considered high-risk, and users should monitor their wallet activity for unauthorized transfers. Browser data, including saved passwords and cookies, should be cleared to prevent session hijacking attempts.