webmetamaskstart[.]daftpage[.]com

webmetamaskstart.daftpage.com is a phishing domain designed to impersonate MetaMask, a popular cryptocurrency wallet. As of the latest check, 17 out of 95 VirusTotal vendors have flagged this domain as malicious, indicating significant detection across security platforms. The domain was hosted on an IP address associated with Amazon.com, Inc., and registered through OVH, SAS. Although the site is currently offline, it previously aimed to deceive users into providing sensitive cryptocurrency information.

The phishing page mimicked the branding of MetaMask and Ethereum, likely to exploit the trust users place in these platforms. The domain's SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and fraudulent sites due to its ease of access and cost-free nature. The site's platform risk score is 65 out of 100, reflecting a moderate level of threat based on its characteristics and behavior.

PhishDestroy added this domain to its blocklist following its first detection in December 2025. Despite its current offline status, the domain's previous activity highlights the ongoing risks associated with cryptocurrency phishing scams. The use of a reputable hosting provider and SSL issuer suggests a level of sophistication in the setup, aimed at bypassing initial security checks and gaining user trust.