mettamasks-com-io[.]pineapple[.]page

mettamasks-com-io.pineapple.page was registered on 24 October 2025 and is currently active. The site presents the page title “MetaMask Login | Connect to Web3 and Manage”, directly referencing the MetaMask brand, which classifies the domain as a brand‑impersonation vector aimed at cryptocurrency users. Google Safe Browsing has flagged the domain for social engineering, and the seed identifier f5aa0d links it to known malicious activity.

Technical analysis shows the domain resolves to IP 216.150.16.193, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The hosting provider is Vercel Inc., and the site delivers content over HTTPS using a Let’s Encrypt R13 certificate. Detected front‑end frameworks include React and the site enforces HTTP Strict Transport Security (HSTS). The HTTP response code is 200, indicating a fully serving web server.

Reputation services reinforce the malicious assessment. VirusTotal reports 16 of 95 security scanners flagging the domain, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one public blocklist and is actively blocked by the PhishDestroy mitigation service. These signals collectively raise the risk rating to high.

Defenders should treat any traffic to this domain as hostile. Network perimeter controls ought to block the IP 216.150.16.193 and the fully qualified domain name. Endpoint detection rules can be tuned to trigger on the page title “MetaMask Login | Connect to Web3 and Manage” and on the presence of a Let’s Encrypt certificate issued to Vercel. Because the exact content of the page beyond the title has not been crawled, continuous monitoring for changes is advised. Organizations should also educate users about unsolicited requests for MetaMask credentials and enforce multi‑factor authentication for wallet access.