usmeta-maskloogn[.]godaddysites[.]com

This domain, usmeta-maskloogn.godaddysites.com, is actively impersonating MetaMask as part of a crypto scam operation. Analysis indicates the domain was registered through GoDaddy.com, LLC on November 18, 2013, though its malicious use appears recent. The page title, 'Met𝖆mask : Login,' directly mimics the MetaMask brand, confirming intent to deceive users. Infrastructure analysis reveals the domain resolves to IP 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) in the US, and uses GoDaddy nameservers (cns1.secureserver.net, cns2.secureserver.net). The SSL certificate is issued by Go Daddy Secure Certificate Authority - G2, a common provider for both legitimate and malicious sites. The domain is flagged by 21 of 95 security vendors on VirusTotal and appears on two security blocklists (PhishDestroy, PhishingDB). A Gridinsoft trust score of 0/100 further supports its malicious classification. Technologies detected include GoDaddy Website Builder, RequireJS, and HSTS, which may be leveraged to enhance the site's appearance of legitimacy. The HTTP status code 200 confirms the site is currently accessible. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and confirmed presence on multiple blocklists. Immediate action includes blocking the domain and its resolving IP at network and endpoint levels. Given the crypto scam classification, monitoring for related wallet addresses or transaction patterns associated with this domain is recommended. The exact content of the site has not been analyzed, so additional indicators (e.g., wallet addresses, redirect chains) may emerge upon further investigation.