auuthh-meta-auut[.]pineapple[.]page

The domain auuthh-meta-auut.pineapple.page is currently active and has been identified as a high‑risk brand‑impersonation site targeting MetaMask users. The page title returned by the server is “Metamask Login‑welcome”, indicating an attempt to lure victims into credential submission. Google Safe Browsing categorises the URL under SOCIAL_ENGINEERING, and PhishDestroy has already added it to its blocklist.

Infrastructure analysis shows the domain resolves to IP 216.150.1.1, which belongs to the Amazon.com, Inc. network (AS16509) in the United States. The site is hosted on Vercel, as confirmed by the SSL certificate issued by Let’s Encrypt (R13) and by the detected technology stack comprising Vercel, React, and HTTP Strict Transport Security (HSTS). Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 13 of 95 scanners flagging the host as malicious.

The observed attributes confirm a cryptocurrency‑related impersonation campaign, yet the exact payload or credential‑harvesting mechanism remains unseen because the page content has not been manually inspected. No additional hosting or command‑and‑control endpoints have been disclosed, and the site appears on only one public blocklist, suggesting limited distribution at this stage. The combination of high‑risk branding, active status, and multiple vendor detections elevates the threat profile.

Defenders should block DNS resolution for the domain and enforce URL filtering rules that deny connections to the host. Network monitoring should flag outbound HTTPS traffic to IP 216.150.1.1, and endpoint protection solutions should be updated with the indicator set (domain, IP, SSL fingerprint). Users of MetaMask should be advised to verify the authenticity of login portals and to report any unsolicited requests to the official support channels.