metamask-docs-consensys-ddffed67[.]vercel[.]app

This domain, metamask-docs-consensys-ddffed67.vercel.app, is actively engaged in brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. The site presents itself as official MetaMask developer documentation, as indicated by the page title 'Home | MetaMask developer documentation.' Current analysis confirms the domain remains operational, posing a high-risk threat to users who may inadvertently disclose sensitive wallet credentials or interact with malicious smart contracts. Infrastructure analysis reveals the domain is hosted on IP address 64.29.17.67, geolocated within the United States under Amazon.com, Inc. (AS16509). The domain was registered through Vercel Inc. and is secured with an SSL certificate issued by Google Trust Services (WR1). Detection metrics indicate the domain has been flagged by 10 of 95 security vendors on VirusTotal, while three distinct security blocklists have incorporated it into their denylists. The page title and visual design closely mimic legitimate MetaMask documentation, increasing the likelihood of successful deception. As of the latest assessment, the domain remains active and continues to resolve. Organizations and end-users are advised to implement immediate countermeasures, including DNS-level blocking of the domain and its associated IP address. Network administrators should update intrusion detection systems to recognize this indicator of compromise. Users who may have interacted with the site should revoke any connected wallet permissions, rotate credentials, and monitor transaction histories for unauthorized activity. Proactive dissemination of this intelligence to cryptocurrency communities is recommended to mitigate further exposure.