auth-sso-metamask[.]daftpage[.]com

This domain, auth-sso-metamask.daftpage.com, is flagged for brand impersonation targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the site presented a fraudulent login interface titled 'Login | MetaMask Developer,' designed to harvest credentials from users under the pretense of legitimate authentication. No direct evidence of a crypto drainer kit was observed, but the credential-harvesting mechanism aligns with common tactics used in cryptocurrency theft operations. Infrastructure analysis reveals the domain was created on October 24, 2021, and registered through OVH, SAS. It resolves to the IP address 216.150.1.193, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain holds a VirusTotal detection score of 10/95, with security vendors identifying it as malicious. It appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt (R13). Google Safe Browsing status is not explicitly provided, but the domain's inclusion in threat intelligence feeds confirms its malicious classification. As of the latest assessment, auth-sso-metamask.daftpage.com has been taken offline, likely due to enforcement actions by hosting providers or security entities. Despite its inactive status, residual risk persists for users who may have interacted with the domain prior to its takedown. Organizations and individuals are advised to monitor for unauthorized access attempts linked to MetaMask accounts and revoke any suspicious sessions. Network-level blocking of the domain and its associated IP (216.150.1.193) is recommended to prevent potential re-emergence or lateral movement within compromised environments.