secure-app-metamask[.]daftpage[.]com

The domain secure-app-metamask.daftpage.com is actively serving a site that claims to provide MetaMask login. Google Safe Browsing classifies it under SOCIAL_ENGINEERING, and VirusTotal records 10 out of 95 scanners flagging the domain. It appears on a single security blocklist and has been blocked by PhishDestroy. The brand target is MetaMask and the scam type is cryptocurrency, indicating attempts to harvest wallet credentials.

The domain was registered on October 24, 2021 through OVH SAS. DNS resolution points to IP 216.150.16.193, an Amazon.com, Inc. address (AS16509) located in the United States. Authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with a Vercel deployment. The HTTP response is a 308 permanent redirect and TLS is provided by a Let’s Encrypt R13 certificate, confirming a valid HTTPS endpoint. Detected web technologies include Node.js, React, Next.js, Vercel, HSTS, Google Analytics, and Crisp Live Chat, suggesting a modern single‑page application framework. The page title returned is “Login to MetaMask – Secure Wallet Access*”, directly referencing the MetaMask brand.

While infrastructure and vendor flags provide strong evidence of malicious intent, the exact payload delivered to victims has not been captured and internal site behavior beyond the title remains unverified. Defenders should treat the domain as a credential‑harvesting site and assume possible downstream cryptocurrency‑draining activity. Recommended actions include adding the domain to network deny lists, configuring web filters to block any HTTP/HTTPS traffic to the associated IP and host, and monitoring for outbound connections to the identified IP range. Continuous threat‑intel monitoring should be maintained for emerging indicators, and any potentially compromised accounts should be instructed to rotate credentials and revoke associated tokens.