metmaskextension[.]vercel[.]app

This domain is flagged as high-risk due to brand impersonation directed at Aave. The risk level is elevated because the domain attempts to deceive users by mimicking a popular cryptocurrency platform, potentially leading to credential theft or other malicious activities. The page title misleadingly references a well-known Web3 and crypto wallet service, further enhancing the threat perception.

Infrastructure analysis reveals that the domain resolves to IP 64.29.17.67, which is located in the United States and registered under Amazon.com's AS16509. The domain was created on February 27, 2026, and is registered through Vercel Inc. The SSL certificate is issued by Google Trust Services / WR1. Furthermore, VirusTotal detected the domain as malicious in 5 out of 95 security vendor checks, indicating a moderate level of recognition among security tools. The domain appears on three blocklists, including those of PhishDestroy, MetaMask, and SEAL, further confirming its malicious intent.

To mitigate the risks associated with this brand impersonation threat, users are advised to avoid engaging with the domain and ensure that they only access the legitimate Aave platform through verified links. Organizations should block this domain at the network level and alert users to the potential for credential theft and other security risks. Continuous monitoring of domain activity and user education on recognizing phishing and impersonation threats are critical steps in minimizing exposure to such high-risk domains.