metamask-io[.]daftpage[.]com

This domain, metamask-io.daftpage.com, poses a high-risk credential phishing threat targeting users of the MetaMask cryptocurrency wallet. The site mimics the official MetaMask login interface, using the page title 'MetaMask Login® - Getting Started with MetaMask™' to deceive visitors into entering sensitive account credentials, recovery phrases, or private keys. Such stolen information can lead to unauthorized access to digital wallets, financial theft, and irreversible loss of cryptocurrency assets. The site is designed to appear legitimate, potentially tricking even experienced users into disclosing critical security details. Analysis indicates this domain is a confirmed phishing operation. It was registered on October 24, 2021, through OVH, SAS, and is flagged by 17 out of 95 security vendors on VirusTotal. The domain resolves to IP address 216.150.16.193, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The site uses a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. It has been blocked by multiple security blocklists and is currently offline, though similar domains may remain active. If you visited metamask-io.daftpage.com and entered any login credentials, recovery phrases, or private keys, immediate action is required. Disconnect any connected devices from the internet and revoke access to all active sessions in your MetaMask wallet. Transfer remaining funds to a new, secure wallet with a fresh seed phrase. Enable two-factor authentication if supported and monitor all linked accounts for unauthorized transactions. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities. Never reuse passwords or recovery phrases across platforms, and verify domain authenticity before entering sensitive information.