support-metamask-app[.]daftpage[.]com

The domain support-metamask-app.daftpage.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting MetaMask users. Intelligence indicates the site serves a crypto‑scam page with the title “Login to MetaMask – Secure Wallet Access*”. The site is protected by a Let’s Encrypt R13 certificate and enforces HSTS, but Google Safe Browsing flags it for SOCIAL_ENGINEERING and six of ninety‑five VirusTotal scanners have issued warnings. Infrastructure analysis shows the domain resolves to 216.150.1.1, an IP owned by Amazon (AS16509) located in the United States, and is hosted on Vercel infrastructure (ns1.vercel-dns.com, ns2.vercel-dns.com). The web stack includes Node.js, React, Next.js and embeds YouTube, Google Analytics and Crisp Live Chat, suggesting a fully functional front‑end designed to resemble a legitimate MetaMask login portal. The domain was registered through OVH SAS on 24 Oct 2021 and appears on one public blocklist, having been blocked by PhishDestroy. While the page content has not been directly examined, the combination of brand impersonation, crypto‑scam classification, and the presence of credential‑type wording strongly implies phishing intent. Defenders should immediately block the domain at DNS and web‑filter layers, monitor for related subdomains, and update threat‑intel feeds with the observed indicators, including the IP address, SSL fingerprint, and observed technologies. Continuous observation is advised to detect any evolution of the payload or additional malicious hosts.