ScanMalware.com

Security Scan Report: metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app

Redirected to:
https://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded...
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/5dd76587-74a2-4ed8-b361-3bfea3b083eaDomain and IP registration (RDAP)/api/v1/rdap/5dd76587-74a2-4ed8-b361-3bfea3b083eaHow often this domain was scanned/api/v1/domain/stats/metamask-docs-4q672pqsp-consensys-ddffed67.vercel.appScan history for this domain/api/v1/domain/history/metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app?limit=15
This website contacted 36 IPs in 2 countries across 23 domains to perform 720 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded-wallets/authentication/

Effective URL:
https://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded...
Redirected

AI Security Verdict

Moderate Risk

Confidence: 60%

5
Risk Score

MetaMask developer-docs content served from an unverified Vercel preview subdomain, not MetaMask's official docs domain. No credential or payment forms, no malware or Indicators of Compromise; 'Facebook impersonation' flag is a false positive from documented OAuth providers.

Risk Factors (2)
Unverified brand-bearing hostname: 'metamask' and 'consensys' appear in a Vercel subdomain that is not an official MetaMask/Consensys domain, which could mislead developers.
Hosted on a shared cloud platform where the subdomain's true creation date is unknown and content can be published instantly.
Safety Factors (4)
No credential, password, or payment fields - no data-harvesting form on the page.
No threat-intelligence matches, no YARA/JS malware, no Safe Browsing or malicious kit detection.
No obfuscated JavaScript, no credential exfiltration, and no cross-origin form submissions.
Page loads genuine documentation tooling (HubSpot, Segment, LaunchDarkly, Google Analytics) and ranked third-party script hosts, consistent with a real docs preview deployment rather than a phishing kit.
Domain age information unavailable

Details

Page Title

Authentication | MetaMask developer documentation

Scan Type

public

Domain Name Analysis

The domain 'metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app' uses the application-focused generic top-level domain (.app); it also runs on subdomain 'metamask-docs-4q672pqsp-consensys-ddffed67'. The registrable portion 'vercel' spans 6 characters holding 2 vowels versus four consonants. It segments into two words: ver, cel. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded-wallets/authentication/

Page Load Overview

39.17s
Total Load Time
6.3 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:4,517 chars
Detector Agreement:80%

Website Classification

Primary Category

technology software75% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
75%
cryptocurrency blockchain
73%
documentation technical
44%
corporate
35%
cryptocurrency
30%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
2064.29.17.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2064.29.17.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
20104.17.207.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2064.239.109.65Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
20142.251.110.97Google · CDNUnited States
AS15169Google LLC
20104.16.139.209Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
20146.75.121.55Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
203.174.47.131Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
20104.17.175.201Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
20172.64.147.16Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
72036--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T160C320399110887F6526AAD7AA5AA3E8E007724DC534D774F27D4B3EEF01E604627CB3

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:zsY/H5gnvOsY383eB+YzYqqKRkBnerG9xVsGPjPqkU223r27e1nOkznzPleu3fTd:3/H58visPqqSa90GrikU2z7j/X2txwk

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:126014:rABEB6QBAJRqNyMDMBAIsDiQiABw4OQYICmf1DJDIEEDCjQMVDijDBJKgzEC8A48jwEyEQkNQDkBiRJAAwQp1GoGBEGgAGBx

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:001f838383df9fc6
Perceptual Hash:bc4a5703752a7978
Difference Hash:88a937263eb62e3e
Wavelet Hash:001fc3c3c38fcfc6
Color Hash:#3a7868

Other Hashes

Crop Resistant:88a937263eb62e3e

Scan History

Scan history not available

Unable to load historical scan data