meta-mekssign[.]godaddysites[.]com

This domain, meta-mekssign.godaddysites.com, is actively flagged as a high-risk phishing site targeting users of the MetaMask cryptocurrency wallet. Analysis indicates the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and is currently hosted on infrastructure belonging to Amazon.com, Inc. (AS16509), resolving to the IP address 13.248.243.5. The page title, 'M𝓮taMask l𝓸gin | Official,' explicitly impersonates MetaMask, a well-known cryptocurrency service, and the domain has been classified under brand impersonation and phishing scam types. Infrastructure analysis reveals the use of GoDaddy Website Builder, RequireJS, and HSTS, with an SSL certificate issued by GoDaddy.com, Inc. via the Go Daddy Secure Certificate Authority - G2. The domain returns an HTTP 200 status, indicating it is operational and serving content. It appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 16 out of 95 security vendors on VirusTotal, reinforcing its malicious classification. The Gridinsoft trust score of 0/100 further corroborates the high-risk assessment. While the domain’s registration and hosting details are clear, the exact content and functionality of the phishing page remain unconfirmed. The use of Unicode characters in the page title ('M𝓮taMask') suggests an attempt to evade basic detection mechanisms by altering visual presentation while maintaining recognizability to targets. Defenders should treat this domain as an active threat, particularly in environments where MetaMask or cryptocurrency-related services are used. Organizations and users are advised to block access to meta-mekssign.godaddysites.com at the network level, update endpoint protection rules, and monitor for any attempts to interact with this domain. Given its recent creation and active status, continued vigilance is recommended, as the operators may pivot to alternative domains or infrastructure if this one is disrupted.