metamakslogi[.]godaddysites[.]com

This domain, metamakslogi.godaddysites.com, is identified as a high-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the infrastructure was designed to mimic the official MetaMask platform, likely to facilitate credential theft or crypto asset compromise. The page title, 'The crypto wallet for Defi, Web3 Dapps and NFTs | MetaMask,' directly mirrors the legitimate MetaMask branding, increasing the likelihood of successful deception among users seeking Web3 services. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. Security telemetry shows the domain is flagged by 20 out of 95 security vendors on VirusTotal, appears on two security blocklists, and is explicitly labeled as phishing by Google Safe Browsing. Additional defensive measures include blocking by PhishDestroy and PhishingDB. As of the latest verification, the domain has been taken offline, reducing immediate exposure to end users. However, the underlying infrastructure remains a residual risk, particularly if the threat actors repurpose the hosting environment or domain registration details for future campaigns. Users who may have interacted with this domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators to prevent potential re-emergence.