mett-a-massk-loogiin[.]godaddysites[.]com

Analysis of mett-a-massk-loogiin.godaddysites.com (seed ca4cf6) confirms an active credential-phishing campaign targeting MetaMask users. The domain, registered on February 21, 2026, via GoDaddy.com, LLC, resolves to IP 13.248.243.5 within Amazon’s US network (AS16509). The page title, 'Met𝓪Mask Login | 👌Login 👌| Signup,' explicitly signals intent to impersonate the MetaMask cryptocurrency wallet, aligning with the scam type labeled as credential phishing in available threat intelligence. Infrastructure checks reveal the site was built using GoDaddy Website Builder and incorporates RequireJS and Re:amaze, though these technologies are not inherently malicious. The domain appears on one security blocklist (PhishDestroy) and holds a Gridinsoft trust score of 0/100.

Eighteen of 91 security vendors on VirusTotal flag the domain as malicious, providing further evidence of its fraudulent nature. Nameservers are hosted on cns1.secureserver.net and cns2.secureserver.net, consistent with GoDaddy’s infrastructure. The SSL certificate, issued by GoDaddy Secure Certificate Authority, does not mitigate the threat, as phishing sites commonly use valid certificates to appear legitimate. Defenders should treat this domain as high-risk.

The HTTP 200 status indicates the page is currently active and serving content. While the exact mechanics of the phishing kit remain unanalyzed, the combination of a MetaMask-themed page title, low trust scores, and multiple vendor detections strongly supports blocking or monitoring access to this domain. Network-level protections, such as DNS filtering or endpoint detection rules, are recommended to prevent user exposure. Further investigation into the hosting IP and associated domains may uncover additional infrastructure linked to this campaign.