wallet-meta-mask-cdn-us[.]vercel[.]app

This domain, wallet-meta-mask-cdn-us.vercel.app, is flagged as a high-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the domain was designed to mimic legitimate MetaMask infrastructure, likely to deceive users into divulging sensitive credentials or interacting with malicious smart contracts. The page title, 'MetaMask Wallet,' reinforces the impersonation attempt, suggesting the presence of a fake login interface or crypto drainer kit intended to siphon digital assets from victims. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 216.198.79.3, hosted on AS16509 (Amazon.com, Inc.) in the United States. It was registered on February 21, 2026, through Tucows Domains Inc., and holds an SSL certificate issued by Google Trust Services (WR1). VirusTotal detection shows 22 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and has been blocked by multiple threat intelligence platforms, including MetaMask’s internal systems. As of the latest assessment, wallet-meta-mask-cdn-us.vercel.app has been taken offline, reducing immediate exposure. However, residual risk remains due to the domain’s prior activity and registration details. Organizations and users are advised to verify all MetaMask-related domains against known legitimate sources, monitor for similar impersonation attempts, and implement blocklist updates to prevent access to related malicious infrastructure. Continuous vigilance is recommended, as threat actors may re-deploy similar domains using comparable tactics.