sign-in-metamask-help[.]daftpage[.]com

This domain, sign-in-metamask-help.daftpage.com, is an active phishing infrastructure targeting MetaMask users as of July 12, 2026. Analysis indicates the domain was registered on October 24, 2021, through OVH, SAS and currently resolves to IP 216.150.1.129 (US, AS16509). The page title, 'Sign In | MetaMask* - Help,' explicitly impersonates MetaMask, a cryptocurrency wallet service, aligning with the classified scam type of cryptocurrency phishing. The domain is flagged by 9 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. A Gridinsoft trust score of 0/100 further supports its malicious classification. Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and technologies including Node.js, React, Next.js, and HSTS. The presence of a Let's Encrypt SSL certificate (R13) suggests an attempt to appear legitimate, while detected technologies like Google Analytics and Crisp Live Chat may be leveraged for tracking or social engineering. The domain returns an HTTP 308 status, which could indicate redirection to another malicious endpoint, though the exact behavior remains unconfirmed without further analysis. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and association with a known phishing kit (Seed Phrase Phishing). The domain's age and hosting infrastructure do not align with typical legitimate MetaMask support pages, reinforcing its fraudulent nature. Organizations are advised to block traffic to this domain and monitor for related infrastructure, particularly domains leveraging similar naming conventions or Vercel hosting. Further investigation into the redirection chain and associated IP addresses is recommended to identify additional compromised endpoints.