portal-metamaskio[.]daftpage[.]com

This domain, portal-metamaskio.daftpage.com, is actively impersonating MetaMask, a cryptocurrency wallet service, as confirmed by its page title, 'MetaMask Login | Official site | MetaMask Help.' The domain was registered on October 24, 2021, and remains operational as of July 12, 2026. Infrastructure analysis reveals it is hosted on IP address 216.150.1.65 and utilizes a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. The domain is registered through OVH, SAS, and employs technologies including Node.js, React, Next.js, and Google Analytics, suggesting a structured phishing framework designed to mimic legitimate login portals. Security vendor assessments indicate a high-risk classification, with 9 out of 95 engines on VirusTotal flagging the domain as malicious. Additionally, it appears on one security blocklist, reinforcing its suspicious status. The Gridinsoft trust score of 0/100 further corroborates the domain's association with phishing activity. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, active status, and detection by multiple security tools aligns with known phishing tactics targeting cryptocurrency users. Defenders should prioritize blocking this domain at the network level, particularly in environments where MetaMask or similar services are utilized. The use of HSTS and Crisp Live Chat may indicate attempts to appear legitimate or engage victims interactively, though this remains speculative without further analysis. Given the domain's age and continued activity, it is likely part of a persistent campaign rather than an opportunistic scam. Monitoring for related infrastructure, such as subdomains or linked IPs, may uncover additional threats associated with this actor. No attribution to a specific threat group or kit is currently available from the provided data.