public-metmasken-us-portal[.]daftpage[.]com

This domain public-metmasken-us-portal.daftpage.com is flagged as an active brand impersonation targeting MetaMask with a wallet phishing classification. The page title is listed as Daftpage and the record shows a high risk level along with an active status as of the July 12 2026 report date. Infrastructure details include creation on October 24 2021 through OVH SAS along with nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The domain resolves to IP address 216.150.16.193 located in the United States under AS16509 Amazon.com Inc. and returns an HTTP status code of 308 with an SSL certificate issued by Let's Encrypt R13.

Analysis indicates the domain employs technologies including Node.js Vercel React Next.js HSTS Google Analytics and Crisp Live Chat. VirusTotal reports detections by 8 out of 95 vendors and the domain appears on 1 security blocklist while carrying a Gridinsoft trust score of 0 out of 100. It is already blocked by PhishDestroy. These indicators establish the domain as a confirmed threat but leave open questions around the exact duration of operation prior to initial detection and any additional subdomains that may share the same infrastructure.

Defenders should block the domain and its associated IP address 216.150.16.193 at network perimeters and update internal allow lists accordingly. Monitoring for new registrations under the same nameservers or registrant patterns can surface related activity while continued checks against blocklists and VirusTotal provide ongoing validation of status. Organizations protecting MetaMask users are advised to incorporate the exact domain string into detection rules without relying solely on page content analysis since the full site payload has not been examined.