us-metamsk-logn[.]pineapple[.]page

This domain, us-metamsk-logn.pineapple.page, poses a specific brand impersonation threat by masquerading as the legitimate MetaMask login page. It attempts to trick users into entering their cryptocurrency wallet credentials, which could lead to theft of digital assets. The page title, "MetaMask Login – Secure Your Crypto Wallet," is designed to appear authentic, but the domain name uses a typo-squatting technique ("metamsk" instead of "metamask") to deceive visitors. The risk level is high, and the site has already been taken offline, but users who interacted with it before takedown remain at risk.

Evidence from threat intelligence confirms the malicious nature of this domain. VirusTotal analysis shows that 17 out of 95 security vendors flag this domain as malicious, indicating strong consensus among the security community. The domain was registered through Vercel Inc., a legitimate web hosting and cloud platform, which may have been abused by the threat actor. It resolves to IP address 216.150.1.1 and appears on at least one security blocklist. Google Safe Browsing specifically flags the domain for phishing. The SSL certificate was issued by Let's Encrypt (R13), which is commonly used for both legitimate and malicious sites, so that alone is not a reliable indicator. The unique seed for this analysis is ce7cfa.

If users visited this domain, they should immediately change their MetaMask password and enable two-factor authentication if not already done. They should also check for any unauthorized transactions on their wallet and consider moving funds to a new wallet address. It is crucial to never enter credentials on sites accessed via suspicious links or emails; always navigate directly to the official MetaMask website. Users can report the domain to Google Safe Browsing and other security services to help protect others. Staying vigilant against phishing attempts is essential in the cryptocurrency space, where such attacks are increasingly common.