secure-metmskio-eng-z0suq[.]daftpage[.]com

This domain, secure-metmskio-eng-z0suq.daftpage.com, poses a credential harvesting threat by impersonating the MetaMask cryptocurrency wallet login interface. Analysis of the page title, 'MetaMask Login – Secure Access to Web3,' confirms it mimics the legitimate service to deceive users into submitting sensitive wallet credentials, seed phrases, or private keys. The domain specifically targets cryptocurrency users, exploiting trust in the MetaMask brand to facilitate unauthorized access to digital assets. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on October 24, 2021, through OVH, SAS, and resolves to IP address 216.150.16.129 hosted on Amazon.com, Inc. (AS16509). Security vendors flagged the domain in VirusTotal, with 16 out of 95 engines detecting it as malicious. It appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (R13). The combination of brand impersonation, low detection coverage, and hosting on a common cloud provider aligns with known phishing infrastructure patterns. Users who visited secure-metmskio-eng-z0suq.daftpage.com should assume their credentials or seed phrases were compromised. Immediate actions include revoking access to any connected wallets, transferring funds to a new wallet with a fresh seed phrase, and monitoring for unauthorized transactions. MetaMask users should verify the authenticity of login pages by checking the URL against the official domain and enabling hardware wallet or multi-factor authentication where possible. System scans for malware are recommended to rule out secondary infections from browser-based threats.