m-mettamusklo[.]godaddysites[.]com

The domain m-mettamusklo.godaddysites.com was identified as a brand impersonation threat mimicking MetaMask, a popular cryptocurrency wallet. This phishing site is designed to trick users into revealing their MetaMask login credentials by presenting a fraudulent login page titled 'Met𝖆mask Login | Sign In'. The threat level is high, and the site is now offline. No specific drainer kit was detected, but the impersonation alone poses a significant risk to users who may unknowingly enter sensitive information.

Technical indicators reveal that the domain has a VirusTotal detection score of 15 out of 95 security vendors flagging it as malicious, indicating broad recognition of its harmful nature. The domain was registered through GoDaddy.com, LLC and created on November 18, 2013, but the current subdomain appears to be newer. It resolves to IP address 76.223.105.230 and uses an SSL certificate issued by GoDaddy.com, Inc. The site appears on three security blocklists, underscoring its malicious reputation. Google Safe Browsing status is not explicitly mentioned, but the high blocklist count suggests potential blacklisting.

As of the latest investigation, the phishing site has been taken offline, which is a positive outcome. Response actions likely involved reporting to the hosting provider and security vendors. However, residual risk remains if cached versions or similar domains continue to operate. Users are strongly advised to always verify URLs before entering credentials, enable two-factor authentication, and report any suspicious links to security teams. PhishDestroy recommends using browser extensions that block known phishing domains and staying informed about common impersonation tactics.