ScanMalware.com

Security Scan Report: metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app

Redirected to:
https://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded...
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/6da6d4af-763e-4065-aec3-a1ea3dbdbf78Domain and IP registration (RDAP)/api/v1/rdap/6da6d4af-763e-4065-aec3-a1ea3dbdbf78How often this domain was scanned/api/v1/domain/stats/metamask-docs-4q672pqsp-consensys-ddffed67.vercel.appScan history for this domain/api/v1/domain/history/metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app?limit=15
This website contacted 32 IPs in 2 countries across 23 domains to perform 723 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded-wallets/sdk/

Effective URL:
https://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded...
Redirected

AI Security Verdict

Low Risk

Confidence: 55%

3
Risk Score

Documentation-style MetaMask SDK page on an unranked vercel.app subdomain with no credential, payment, IoC, YARA, or exfiltration evidence. Provenance unverifiable; risk capped at moderate with no concrete malicious signal.

Risk Factors (3)
MetaMask brand shown on an unranked vercel.app subdomain rather than the official MetaMask/Consensys domain — provenance of this deployment cannot be verified from the scan
Actual creation date of the vercel.app subdomain is unknown; anyone can publish to such a subdomain at any time
Two MEDIUM Suricata alerts for vercel.app as an 'actor-abused cloud hosting' service (generic abuse-reputation context, not a malware/phishing verdict)
Safety Factors (6)
No password, disguised-password, or payment fields present — no credential or payment harvesting
No Indicators of Compromise matched against the page or its loaded resources
No JavaScript malware (YARA), no known malicious kit, no suspicious WebAssembly/script findings
No cross-origin credential submission and no credential exfiltration detected
All 7 third-party script hosts are ranked in the top-1M popularity list (HubSpot, Google Analytics, Segment, LaunchDarkly, jsDelivr) and the page reads as coherent product documentation
Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 4 to 3
Domain age information unavailable

Details

Page Title

MetaMask Embedded Wallets | MetaMask developer documentation

Scan Type

public

Domain Name Analysis

The domain 'metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app' uses the application-focused generic top-level domain (.app) with subdomain 'metamask-docs-4q672pqsp-consensys-ddffed67'. The registrable portion 'vercel' spans 6 characters holding 2 vowels versus 4 consonants. It segments into two words: ver, cel. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://metamask-docs-4q672pqsp-consensys-ddffed67.vercel.app/embedded-wallets/sdk/

Page Load Overview

28.68s
Total Load Time
3.4 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:2,732 chars
Detector Agreement:40%

Website Classification

Primary Category

technology software58% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
58%
cryptocurrency blockchain
45%
documentation technical
40%
corporate
35%
cryptocurrency
30%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4164.29.17.67Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
22216.198.79.131Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
22104.17.207.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2264.239.109.65Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
22142.251.110.97Google · CDNUnited States
AS15169Google LLC
22146.75.121.55Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
223.174.47.131Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
22104.18.30.173Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
22104.16.139.209Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
22104.17.175.201Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
72332--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C6D363389150847E6426ABD7DA5AA3E8E007728EC534D778F37D4B39EF01EA14526CB3

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:1eWY/H5gnvOsY383eBQ0zYqqKRkBnerG9xVsGPjPqkUeU23r27rrp77NxAXhwEQK:6/H58vis/FqqSa90GrikUzz7pwxwk

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:138676:yEOgMBBgJCOQIq2GgQAIRF4QWoiI0AAgkYwQAJERycA0hAuMOI2hdLm8NjpwqFADGTAqIkxYEJHTQWGAwVtGsEFaCAMBAIic

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:000f1fff4f5f7f80
Perceptual Hash:9013532875ce7f3a
Difference Hash:a898b8a6b6b6a7b8
Wavelet Hash:000e3f7f0f5f7b00
Color Hash:#2d8665

Other Hashes

Crop Resistant:a898b8a6b6b6a7b8

Scan History

Scan history not available

Unable to load historical scan data