metamask-transaction[.]vercel[.]app

Analysis indicates that the domain metamask-transaction.vercel.app is actively hosting a malicious site that impersonates MetaMask for crypto‑related fraud. The domain was registered on 22 November 2025 through Vercel Inc. and resolves to IP 216.198.79.195, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The server presents a valid TLS certificate issued by Google Trust Services (WR1) and enforces HTTP Strict Transport Security. HTTP requests return status 200 and the page title is “Application error: a client‑side exception has occurred,” suggesting the front‑end code is either broken or deliberately obscured. Google Safe Browsing classifies the URL as “SOCIAL_ENGINEERING,” and Gridinsoft assigns a trust score of 0/100, reflecting a high likelihood of malicious intent. VirusTotal analysis shows that 12 out of 95 scanners flag the domain, and the site is listed on at least one public blocklist and has been blocked by PhishDestroy. The observed indicators collectively point to a high‑risk crypto scam that leverages MetaMask branding to lure victims. Current uncertainty includes the exact content delivered to end users, as the page title indicates an error page rather than a visible phishing form. Defenders should block the domain at network perimeters, update URL filtering lists, and monitor for any related infrastructure that may share the same IP or certificate. Continuous observation is recommended to capture any changes in payload or hosting configuration.