metamusk[.]pineapple[.]page

This domain, metamusk.pineapple.page, is actively impersonating MetaMask, a cryptocurrency wallet service, as part of a crypto scam operation. Analysis indicates the domain is hosted on infrastructure associated with Vercel Inc. and resolves to the IP address 216.150.16.1, part of AS16509 (Amazon.com, Inc.) in the United States. The page title, 'Metamask® Login : Simple Steps for Secure Crypto®,' explicitly mimics MetaMask branding, reinforcing its fraudulent intent. Security vendor detections are limited but notable: 12 of 95 engines on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. Google Safe Browsing has classified the domain under the 'SOCIAL_ENGINEERING' category, further confirming its deceptive nature. The domain employs a Let's Encrypt SSL certificate (R13) and enforces HSTS, which may lend a superficial appearance of legitimacy but does not mitigate the underlying threat. Technical indicators reveal the use of Vercel hosting and React framework, common in phishing campaigns due to their ease of deployment and scalability. The domain remains active as of July 12, 2026, with an HTTP 200 status code, indicating the fraudulent page is operational. No evidence of takedown requests or sinkholing is present in available intelligence. Defenders should prioritize blocking this domain at the network level, particularly in environments where cryptocurrency-related services are accessed. Given the high-risk classification and active status, monitoring for related infrastructure (e.g., subdomains, associated IPs) is recommended to preempt further abuse. The exact content of the phishing page has not been analyzed, but the combination of brand impersonation, social engineering classification, and crypto scam designation warrants immediate containment.