secure-metmkien-web[.]daftpage[.]com

Analysis indicates that the domain secure-metmkien-web.daftpage.com is actively serving a credential-collection site targeting MetaMask users. The site presents the page title "Log-In | Metamask®", directly referencing the wallet brand, and is classified as a crypto-scam. Infrastructure details show the domain resolves to 216.150.1.129, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with hosting on the Vercel platform. The TLS certificate is issued by Let’s Encrypt (R13), and the HTTP response is a 308 permanent redirect, suggesting intentional URL manipulation.

Malware and phishing detection services have flagged the domain; fifteen of ninety-five VirusTotal scanners raise alerts, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on one external blocklist, identified by PhishDestroy, confirming that at least one protective service has already taken mitigation action. The domain was registered on 24 October 2021 through OVH, SAS, and the registration information remains unchanged. Detected web technologies include Node.js, React, Next.js, Vercel, Google Analytics, Crisp Live Chat, and embedded YouTube content, all of which are typical of modern phishing kits. HSTS is enabled, which may help prevent downgrade attacks but does not mitigate the underlying credential-stealing intent.

While the available data confirms active hosting and multiple detection signals, the exact payload delivered to victims, such as form fields or exfiltration endpoints, has not been captured in the current intelligence set. Consequently, the full scope of user impact remains uncertain. Defenders should block the IP address 216.150.1.