a-mettamaxsk-logjiin[.]godaddysites[.]com

This domain, a-mettamaxsk-logjiin.godaddysites.com, is flagged for brand_impersonation targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the domain was designed to mimic legitimate MetaMask login portals, likely to harvest credentials or sensitive financial data. The domain is currently offline, but prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on November 18, 2013, an unusually long lifespan for a malicious domain, which may have been repurposed. It resolves to IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 20 of 95 security vendors on VirusTotal. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, which does not inherently validate the domain's legitimacy. The page title, 'Met𝖆mask Login,' uses Unicode characters to obfuscate the impersonation, a common tactic to evade detection. Current status confirms the domain is offline, reducing immediate risk to users. However, the historical activity and infrastructure warrant continued monitoring. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator of compromise. Users who may have interacted with the domain should reset credentials for any associated accounts, particularly cryptocurrency wallets, and enable multi-factor authentication where available. Security teams should review logs for connections to 13.248.243.5 or requests to the domain to identify potential compromise.