hels-metamusk-log[.]pineapple[.]page

The domain hels-metamusk-log.pineapple.page is identified as a high-risk brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. This domain was operational as a phishing site, presenting a fraudulent login interface under the page title 'Metamask Login® | Official Site®' to deceive users into disclosing sensitive credentials. Analysis indicates the infrastructure was designed to mimic legitimate MetaMask authentication portals, increasing the likelihood of successful credential harvesting. Infrastructure analysis reveals the domain was registered through Vercel Inc. and resolved to the IP address 216.150.1.129, hosted on Amazon.com, Inc. infrastructure (AS16509) located in the United States. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. A total of 15 out of 95 security vendors on VirusTotal detected this domain as malicious. The SSL certificate was issued by Let's Encrypt (R13), a common practice among threat actors to lend superficial legitimacy to phishing sites. No creation date was provided in available intelligence, but the domain has since been taken offline. Current status indicates the domain is no longer active, reducing immediate risk to end users. However, the infrastructure and tactics observed align with persistent phishing campaigns targeting cryptocurrency services. Users who may have interacted with this domain are advised to immediately revoke any active sessions, change passwords, and enable multi-factor authentication on their legitimate MetaMask accounts. Organizations should update security blocklists to include this domain and monitor for similar impersonation attempts using Vercel-registered domains or Let's Encrypt certificates in phishing contexts. Proactive threat hunting for related indicators, such as the IP address 216.150.1.129, is recommended to identify potential lateral movement or secondary payload delivery.