metamaskhelp[.]daftpage[.]com

This domain, metamaskhelp.daftpage.com, is classified as high-risk due to its brand impersonation targeting MetaMask. The threat primarily involves deceiving users with a fake login page under the guise of providing MetaMask support, posing significant security risks to users who might input sensitive information.

The domain was created on October 24, 2021, under the registrar OVH, SAS, and it resolves to IP address 216.150.1.129 located in the US, hosted on infrastructure owned by Amazon.com, Inc. According to VirusTotal analysis, 12 out of 95 security vendors have flagged this domain for malicious activity. Additionally, Google Safe Browsing identifies it as a phishing site. The domain has been included in one security blocklist and has been taken offline by PhishDestroy, indicating the seriousness of the threat.

Mitigation steps include educating users about the characteristic signs of phishing websites, such as unfamiliar URLs and demanding sensitive information. Users should ensure that they access services such as MetaMask directly through official channels and verify SSL certificates before inputting any credentials. Organizations should also bolster their security infrastructure to detect and block phishing attempts proactively and incorporate domain blocklists in their security protocols.