Security Scan: MetaMask

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/0896ec48-8839-4dba-bc40-331047887cd2 Domain and IP registration (RDAP)/api/v1/rdap/0896ec48-8839-4dba-bc40-331047887cd2How often this domain was scanned/api/v1/domain/stats/nkbihfbeogaeaoehlefnkodbefgpgkn-reset.vercel.app Scan history for this domain/api/v1/domain/history/nkbihfbeogaeaoehlefnkodbefgpgkn-reset.vercel.app?limit=15

This website contacted 5 IPs in 1 country across 3 domains to perform 10 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://www.nkbihfbeogaeaoehlefnkodbefgpgkn-reset.vercel.app/

Effective URL:

https://nkbihfbeogaeaoehlefnkodbefgpgkn-reset.vercel.app/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Fake MetaMask wallet page on a vercel.app subdomain using the extension ID in its hostname, collecting a password with a 'Forgot password?' lure. Brand impersonation plus credential harvesting — do not enter any password or seed phrase.

Risk Factors (5)

Impersonation of the MetaMask brand on a domain it does not own

Credential/password collection form with no matching username field

Deceptive hostname derived from the MetaMask extension ID

Free hosting-platform subdomain with no verifiable history or reputation

Crypto-wallet recovery lure ('Forgot password?') typical of seed-phrase/password phishing kits

Domain age information unavailable

Details

Page Title

MetaMask

Scan Type

public

Favicon Hash

MMH3: -1538134311

MD5: a0ef9f44421042a99f5132bc5db13b37

Domain Name Analysis

Within the application-focused generic top-level domain (.app), 'www.nkbihfbeogaeaoehlefnkodbefgpgkn-reset.vercel.app' is registered, featuring subdomain 'www.nkbihfbeogaeaoehlefnkodbefgpgkn-reset'. The registrable portion 'vercel' spans 6 characters split between two vowels and 4 consonants. Splitting it apart reveals 2 words: ver, cel. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.68s

Total Load Time

1.5 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:32 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	216.198.79.131Aws · CLOUD	United States	AS16509Amazon.com, Inc.
2	64.29.17.3Aws · CLOUD	United States	AS16509Amazon.com, Inc.
2	104.18.0.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	216.198.79.3Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	104.18.1.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	5	-	-