mmsupport[.]vercel[.]app

This domain, mmsupport.vercel.app, has been identified as a brand impersonation threat specifically targeting MetaMask, a cryptocurrency wallet service. The domain is currently offline but was actively used to deceive users by mimicking MetaMask's official support infrastructure. The page title displayed was 'MetaMask Help Center,' a direct attempt to mislead users into believing they were interacting with legitimate MetaMask resources. Analysis indicates the domain was flagged by 14 out of 95 security vendors on VirusTotal, reflecting a significant detection rate. It appears on one security blocklist and was blocked by at least one security entity. The domain was registered through Vercel Inc. and resolved to the IP address 216.198.79.195, located in the United States under AS16509 (Amazon.com, Inc.). The SSL certificate was issued by Google Trust Services, specifically under the WR1 intermediate. No creation date is available, but the infrastructure analysis reveals the use of a widely recognized hosting provider, which may have facilitated rapid deployment and takedown. The current status of mmsupport.vercel.app is offline, reducing immediate risk to users. However, the domain's prior activity and technical indicators suggest it was part of a broader campaign to exploit trust in MetaMask's brand. Organizations and individuals are advised to block the domain at the network level and monitor for any re-emergence under similar naming conventions. Users should verify the authenticity of any support-related communications by cross-referencing with official MetaMask channels. Security teams are encouraged to review logs for connections to 216.198.79.195 and the domain itself, as these may indicate prior compromise or exposure to the threat.