metamask-guider[.]vercel[.]app

Analysis of the domain metamask-guider.vercel.app indicates a recent brand‑impersonation campaign targeting MetaMask users. The domain was registered on 28 February 2026 through Vercel Inc. and is hosted on Amazon Web Services (ASN AS16509) at IP 64.29.17.195, which resolves to a US location. DNS resolution uses Vercel‑managed nameservers (ns1‑ns4.vercel‑dns‑3.com). An SSL certificate issued by Google Trust Services (WR1) is present, and the site served HTTP 404 responses, suggesting the malicious landing page has been removed.

The page title returned by the server is “MetaMask Help Center,” matching the declared brand target and reinforcing the impersonation intent. Technical fingerprinting shows the site was built with Docusaurus, React, Webpack and deployed on the Vercel platform, with HSTS and Google Tag Manager enabled. Threat intelligence flags the domain as a crypto‑scam; four of ninety‑three VirusTotal scanners flagged the host, and the URL appears on three independent blocklists, including PhishDestroy, MetaMask’s own blocklist, and SEAL. The Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious behavior.

Despite the current offline status, the infrastructure components (AWS hosting, Vercel DNS, valid TLS) could be reused for future impersonation attempts. Defenders should continue to block the domain at perimeter filters, monitor for re‑registration or similar sub‑domains, and enforce strict verification of MetaMask communications. Users should be reminded that legitimate MetaMask support pages are served from official MetaMask domains and that any request to a .vercel.app address claiming to be a MetaMask help center should be rejected. Ongoing observation of the IP address and associated Vercel accounts is recommended to detect potential re‑deployment.