en-metamskhelp[.]daftpage[.]com

This domain, en-metamskhelp.daftpage.com, is actively flagged as a high-risk phishing site targeting MetaMask users. Registered on October 24, 2021, the domain remains operational as of July 12, 2026, and is currently listed on one security blocklist. Analysis indicates the site impersonates MetaMask, as evidenced by the page title 'MetaMask® Login | Getting Started — MetaMask,' which directly mimics the legitimate MetaMask branding. The domain resolves to IP address 216.150.16.129 and is hosted through OVH, SAS, with an SSL certificate issued by Let's Encrypt, a common but not inherently malicious provider. Infrastructure analysis reveals the use of Node.js, React, Next.js, and Vercel, technologies frequently employed in both legitimate and malicious web applications. The presence of Google Analytics and Crisp Live Chat suggests an attempt to appear authentic, though these tools are also used in phishing campaigns to track victims or engage in real-time fraud. Detection metrics from VirusTotal show that 12 out of 95 security vendors flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The exact content and functionality of the site have not been fully analyzed, but the combination of brand impersonation, low trust scores, and active blocklist inclusion strongly indicates malicious intent. Defenders should treat this domain as a confirmed phishing threat and prioritize blocking or monitoring traffic to and from 216.150.16.129. Given the domain's age and continued activity, it may be part of a long-term campaign, and retrospective analysis of historical logs for connections to this IP or domain is recommended. No evidence suggests this is part of a broader kit or infrastructure, but correlation with other MetaMask-themed phishing domains may reveal additional threats.