folkfi[.]org

folkfi.org is a phishing domain that specifically targets MetaMask users. The domain has been taken offline, but not before it was flagged as malicious by 13 out of 92 vendors on VirusTotal. Additionally, it appears on three public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing also flags this domain, indicating its widespread recognition as a threat.

The domain was registered through NameSilo, LLC, and hosted on an IP address located in the Netherlands, managed by Nice IT Services Group Inc. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The page title "One moment…" suggests a potential tactic to stall users while malicious scripts execute in the background.

Despite being offline now, folkfi.org exemplifies how phishing domains can exploit the gap between domain registration and detection by antivirus databases. This domain managed to operate long enough to be flagged by multiple security vendors and blocklists. PhishDestroy's early detection pipeline helps capture such threats during this critical pre-detection window, offering protection before traditional AV databases are updated.