metamaslofin[.]godaddysites[.]com

This domain is flagged as a high-risk brand impersonation site designed to deceive users into believing it is an official MetaMask wallet interface. The site targets individuals managing cryptocurrency assets, aiming to harvest login credentials, recovery phrases, or private keys through fraudulent web forms. While currently displaying a 404 error, the domain’s infrastructure and prior behavior indicate it was actively used in a phishing campaign to exploit trust in the MetaMask brand. Analysis indicates the domain was registered through GoDaddy.com, LLC, with a creation date of February 28, 2026—an anomalous future date suggesting potential manipulation or misconfiguration. It resolves to the IP address 13.248.243.5, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain appears on four security blocklists, including PhishDestroy and PhishingDB, and is flagged by 17 out of 95 security vendors on VirusTotal, confirming its malicious classification. The SSL certificate, issued by GoDaddy, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. If you visited metamaslofin.godaddysites.com or entered any sensitive information, immediate action is required. Disconnect the device from the network to prevent potential data exfiltration. Revoke any active sessions associated with the MetaMask account and generate a new wallet if recovery phrases or private keys were exposed. Monitor linked accounts for unauthorized transactions and report the incident to the official support channel of the targeted service. Users should also update security software and review browser extensions for unauthorized modifications.