portal-metamsk[.]daftpage[.]com

The domain portal-metamsk.daftpage.com is identified as a high-risk brand impersonation resource specifically targeting MetaMask, a widely used cryptocurrency wallet platform. Analysis confirms this domain was actively employed in phishing campaigns designed to harvest user credentials and sensitive financial information. The page title, 'MetaMask Login: The Leading Crypto Wallet Platform,' directly mimics legitimate MetaMask branding to deceive users into entering confidential data. Infrastructure analysis reveals the domain was registered on October 24, 2021, through OVH, SAS, a registrar frequently associated with both legitimate and malicious domains. It resolves to the IP address 216.150.16.65, hosted within the Amazon.com, Inc. autonomous system (AS16509) in the United States. Security telemetry indicates the domain has been flagged by 13 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Let's Encrypt (R13), provides encryption but does not mitigate the underlying malicious intent. As of the latest assessment, portal-metamsk.daftpage.com has been taken offline, reducing immediate exposure risk. However, users who may have interacted with this domain prior to its deactivation are advised to immediately revoke any active sessions, reset credentials, and monitor associated accounts for unauthorized activity. Organizations should update blocklists to include this domain and its resolving IP address to prevent future access attempts. Continuous monitoring of similar impersonation domains is recommended, as threat actors frequently rotate infrastructure to evade detection.