name-explore-mask[.]daftpage[.]com

The domain name-explore-mask.daftpage.com is a high-risk phishing site engaged in brand impersonation targeting MetaMask, a cryptocurrency wallet service. It was designed to deceive users into entering login credentials or sensitive information under the guise of a legitimate MetaMask developer portal. No drainer kit was detected, but the site operated as a cryptocurrency scam. As of the latest verification, name-explore-mask.daftpage.com has been taken offline.

Technical analysis shows that name-explore-mask.daftpage.com was flagged by 14 of 95 security vendors on VirusTotal, including ADMINUSLabs, ChainPatrol, and CyRadar. Google Safe Browsing classified it as a social engineering threat. The domain appeared on one security blocklist, PhishDestroy, and was registered through OVH, SAS on October 24, 2021. It resolved to the IP address 216.150.1.193, hosted on Amazon.com, Inc. infrastructure in the US, and used an SSL certificate issued by Let's Encrypt (R13). The observed page title was 'Login | MetaMask Developer,' and the site employed technologies such as Node.js, React, Next.js, and Google Analytics.

Users who interacted with name-explore-mask.daftpage.com should immediately change their MetaMask and associated account passwords, enable two-factor authentication, and monitor for unauthorized transactions. Cryptocurrency users are advised to revoke any token approvals granted to unknown or suspicious contracts and consider transferring funds to a new wallet. The incident should be reported to MetaMask support and relevant authorities, such as the Anti-Phishing Working Group (APWG) or local cybercrime units, to aid in tracking and mitigation efforts.