metamask-docs-git-feat-ew-signer-consensys-ddffed67[.]vercel[.]app

This domain, metamask-docs-git-feat-ew-signer-consensys-ddffed67.vercel.app, has been identified as a high-risk brand impersonation threat targeting the MetaMask brand. The risk level is high due to the domain's active status and its impersonation of the legitimate MetaMask Developer Documentation, which can mislead users and potentially compromise their security.

Analysis indicates that the domain is flagged by 14 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion among security professionals. The domain is registered through Vercel Inc., and it resolves to the IP address 216.198.79.131, which is located in the United States. The SSL certificate is issued by Google Trust Services, which may provide a false sense of security to unsuspecting users. The domain appears on three known security blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL. The page title 'MetaMask Developer Documentation - Build Web3 Apps | MetaMask' closely mirrors the legitimate MetaMask documentation, enhancing the likelihood of user deception. The exact creation date of the domain is not provided, but the recent appearance on multiple blocklists suggests it is relatively new.

To mitigate the risk of this brand impersonation threat, users should verify the domain's legitimacy by cross-referencing it with the official MetaMask website. Security teams should update their blocklists to include this domain and monitor for any related malicious activities. Additionally, network administrators should configure firewalls and DNS settings to block access to this domain, and users should be educated on recognizing and reporting suspicious web pages that mimic trusted brands.