io-metmsken-help[.]daftpage[.]com

This domain, io-metmsken-help.daftpage.com, is actively impersonating MetaMask as part of a cryptocurrency scam. Registered on October 24, 2021, it resolves to IP 216.150.1.65 (AS16509, Amazon.com, Inc., US) and is hosted on Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com). The page title explicitly claims to offer 'MetaMask Login – Secure Access to Web3,' aligning with the known brand impersonation target. Technologies detected include Node.js, React, Next.js, and Let's Encrypt SSL (R13), suggesting a modern web framework likely designed to mimic legitimate MetaMask authentication flows. The domain currently returns an HTTP 308 redirect, which may indicate an attempt to evade detection or route victims through intermediate pages. As of July 12, 2026, it remains active, with 11 of 95 security vendors flagging it on VirusTotal and one security blocklist listing. The Gridinsoft trust score is 0/100, reinforcing its high-risk classification. Defenders should prioritize blocking this domain at DNS, proxy, and endpoint layers, as well as monitoring for connections to the associated IP. Given the use of Vercel infrastructure, additional related subdomains may exist and should be investigated. The exact phishing mechanism (e.g., credential harvesting, wallet drainer) is not confirmed in available data, but the cryptocurrency scam classification and MetaMask impersonation warrant immediate containment.