securely-metamask-help[.]daftpage[.]com

This domain, securely-metamask-help.daftpage.com, is actively impersonating MetaMask, a cryptocurrency wallet service, as confirmed by its page title 'Login to MetaMask – Secure Wallet Access' and explicit brand targeting in threat intelligence records. Analysis indicates the infrastructure is designed to deceive users into submitting credentials or wallet recovery phrases. The domain was registered on October 24, 2021, through OVH, SAS, and currently resolves to IP address 216.150.1.193. It remains operational as of July 12, 2026, despite being flagged by 10 out of 95 security vendors on VirusTotal and appearing on at least one security blocklist. Technical indicators reveal the use of modern web technologies, including Node.js, React, Next.js, and Vercel, which are consistent with phishing sites aiming to appear legitimate. The presence of Google Analytics and Crisp Live Chat suggests attempts to monitor victim interactions or provide fraudulent support. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and does not inherently validate the site's trustworthiness. The domain's Gridinsoft trust score of 0/100 further supports its classification as malicious. Defenders should treat this domain as high-risk infrastructure due to its active status, brand impersonation, and detection by multiple security vendors. The exact content and functionality of the site remain unanalyzed, but the page title and known intelligence strongly suggest it is designed to harvest MetaMask credentials. Organizations should block the domain and its resolving IP at the network level, monitor for related subdomains or IPs, and alert users to avoid interaction. Given the domain's age and continued activity, it may be part of a broader, persistent campaign targeting cryptocurrency users.