metamask-docs-p13jojaa8-consensys-ddffed67[.]vercel[.]app

This domain presents a high-risk brand impersonation threat targeting MetaMask users. The site mimics official MetaMask developer documentation, using an identical page title (Home | MetaMask developer documentation) to deceive visitors into believing it is legitimate. Such impersonation typically aims to distribute malicious software, harvest credentials, or trick users into authorizing fraudulent transactions by exploiting trust in the targeted brand’s official resources.

Analysis indicates the domain was registered through Vercel on May 12, 2026, and resolves to the IP address 64.29.17.195, hosted by Vercel, Inc. in the United States. The SSL certificate is issued by Google Trust Services (WR1). Security vendors have flagged the domain as malicious, with 19 out of 95 engines on VirusTotal detecting it. Additionally, the domain appears on three security blocklists, and multiple threat intelligence sources have confirmed its association with brand impersonation activities.

If this domain was accessed, immediate action is required. Disconnect the device from the network to prevent potential data exfiltration. Clear all browser data, including cookies and cached files, to remove any stored session tokens or tracking elements. Reset credentials for MetaMask and any other accounts accessed during the session, using a separate, secure device. Scan the system with updated security tools to detect and remove any malware. Monitor financial transactions and account activity for unauthorized actions, and report the incident to relevant security teams for further investigation.