welcome-metamask-help[.]daftpage[.]com

This domain is flagged for brand impersonation targeting MetaMask users through a fraudulent login portal. The threat type is classified as a fake login page designed to harvest cryptocurrency wallet credentials, posing an elevated risk to users who interact with the site. Analysis indicates the domain was specifically crafted to mimic legitimate MetaMask authentication flows, increasing the likelihood of successful phishing attempts. Infrastructure analysis reveals the domain welcome-metamask-help.daftpage.com was registered on October 24, 2021, through OVH, SAS. It resolves to the IP address 216.150.16.193, hosted on Amazon.com, Inc.'s AS16509 network in the United States. The SSL certificate is issued by Let's Encrypt (R13). Security vendors on VirusTotal flagged the domain at a detection rate of 16/95, and it appears on one security blocklist, specifically PhishDestroy. The page title, 'MetaMask Login : Secure Access to Your MetaMask Log-in,' further confirms its intent to deceive users into entering sensitive credentials. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (216.150.16.193) across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint to endpoint detection systems to prevent access. Users who may have interacted with the site should be instructed to reset their MetaMask credentials from a secure device and enable multi-factor authentication. Additionally, security teams should monitor for unauthorized transactions or access attempts linked to credentials potentially exposed through this phishing campaign.