mettam-muskgolinx1[.]godaddysites[.]com

This domain is flagged as a high-risk MetaMask credential theft site designed to harvest cryptocurrency wallet login credentials. Analysis indicates the page title explicitly mimics the official MetaMask interface, using visually similar but distinct Unicode characters (e.g., 𝓪 and 𝖚) to evade detection while presenting a fraudulent login portal. The threat type is narrowly classified as crypto credential theft, targeting users of the MetaMask wallet service with intent to drain funds or hijack accounts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) infrastructure in the US. The SSL certificate is issued by Go Daddy Secure Certificate Authority - G2, a common certificate provider for both legitimate and malicious sites. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask’s internal security systems, and SEAL. No legitimate association with MetaMask or its parent entities exists, and the domain’s creation date postdates known legitimate MetaMask subdomains by several years. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (13.248.243.5) at the network perimeter. Users who may have interacted with the site should revoke active MetaMask sessions, rotate credentials, and audit recent transactions for unauthorized activity. Organizations should deploy browser-based or endpoint security controls capable of detecting Unicode-based spoofing in domain names and page titles. Given the high-risk classification, incident responders should treat any access to this domain as a potential compromise of cryptocurrency credentials and initiate containment procedures accordingly.