ScanMalware.com

Security Scan Report: metamask-docs-ctqr7yuof-consensys-ddffed67.vercel.app

Redirected to:
https://metamask-docs-ctqr7yuof-consensys-ddffed67.vercel.app/agent-wa...
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/02d9beab-ba45-4a74-8110-1f24ba05d65fDomain and IP registration (RDAP)/api/v1/rdap/02d9beab-ba45-4a74-8110-1f24ba05d65fHow often this domain was scanned/api/v1/domain/stats/metamask-docs-ctqr7yuof-consensys-ddffed67.vercel.appScan history for this domain/api/v1/domain/history/metamask-docs-ctqr7yuof-consensys-ddffed67.vercel.app?limit=15
This website contacted 36 IPs in 3 countries across 21 domains to perform 610 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://metamask-docs-ctqr7yuof-consensys-ddffed67.vercel.app/agent-wallet/use-the-cli-directly/

Effective URL:
https://metamask-docs-ctqr7yuof-consensys-ddffed67.vercel.app/agent-wa...
Redirected

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

MetaMask developer documentation cloned onto a vercel.app subdomain, with an OpenPhish phishing report on that domain. No credential/payment form, but brand impersonation plus wallet sign-in and seed-phrase instructions make it unsafe.

Risk Factors (5)
Brand impersonation of MetaMask on a non-official hosted subdomain
Single-source phishing threat-intelligence match on the primary domain
Content instructs users to run 'mm login' (Google/email sign-in) and references supplying a BIP-39 seed phrase — credential/seed-phrase-adjacent lure typical of wallet phishing
Unknown creation date for the vercel.app tenant behind an aged platform apex
IDS alerts for commonly actor-abused cloud hosting service usage
Domain age information unavailable

Details

Page Title

Use the CLI directly | MetaMask developer documentation

Scan Type

public

Domain Name Analysis

The domain name 'metamask-docs-ctqr7yuof-consensys-ddffed67.vercel.app' uses the application-focused generic top-level domain (.app); it also runs on subdomain 'metamask-docs-ctqr7yuof-consensys-ddffed67'. Its registrable label 'vercel' stretches across 6 characters containing two vowels alongside 4 consonants. Splitting it apart reveals two words: ver, cel. Median word length is 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

eta a eta Products Agent Wallet Overview Quickstart Use the CLI directly Guides Send tokens ‘Swap and bridge tokens Trade perpetuals Trade prediction markets Check balances and prices Sign messages...

Page Load Overview

2.08s
Total Load Time
4.8 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:5,669 chars
Detector Agreement:80%

Website Classification

Primary Category

documentation technical80% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

documentation technical
80%
technology software
78%
cryptocurrency blockchain
73%
finance banking
60%
corporate
35%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
50216.198.79.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
16216.198.79.3Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
16151.101.65.229Fastly · CDNUnited States
AS54113Fastly, Inc.
1664.239.123.1Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
16142.251.13.97Google · CDNUnited States
AS15169Google LLC
16146.75.121.55Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
163.174.47.131Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
16104.16.139.209Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
16104.18.30.173Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
16104.17.175.201Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
61036--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T135D3A5389190487F14276BC7A99AA3E8E10B728EC630D774F37D4B79AF41E9055238B3

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:kP58/As96g3PDpPDHPD4PDXPDoFPD65PD0PDbPDgIPDzPDZPDePDMp:o7sQg3PDpPDHPD4PDXPDoPD65PD0PDb1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:141436:gAiVQFMVFACAkDkKJIIA2CEUQwUmdaqAidIPuUE2LcqCEnMS6jdDABAGSFTgzogiCAQagjIQREERapGkKhgIAFRjRBxkBfBC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffdf838383ff
Perceptual Hash:bcc2d32d55c2c32d
Difference Hash:b0b3b1b726263640
Wavelet Hash:009f1f5f818383fe
Color Hash:07000e00000

Other Hashes

Crop Resistant:b0b3b1b726263640,6010106060909060,008000402020c000

Scan History

Scan history not available

Unable to load historical scan data