macc-mettasign1x[.]godaddysites[.]com

The domain macc-mettasign1x.godaddysites.com is currently classified as a high‑risk brand‑impersonation site targeting GoDaddy. The page title observed, "Met𝖆mask Login," suggests an attempt to harvest credentials, and the overall threat type aligns with credential phishing. The site is still active, returning HTTP 200 responses, and its risk level has been set to high based on the combination of observed indicators.

Infrastructure analysis shows the domain resolves to IP address 76.223.105.230, which belongs to ASN16509, an Amazon.com, Inc. network located in the United States. The domain was created on 18 November 2013 and is registered through GoDaddy.com, LLC, using the nameservers cns1.secureserver.net and cns2.secureserver.net. The TLS certificate is issued by Go Daddy Secure Certificate Authority - G2 and bears the GoDaddy.com, Inc. issuer name, indicating a legitimate‑looking HTTPS presence.

Detection data indicate that multiple security scanners have flagged the host, with 14 of 95 vendors reporting malicious activity. The domain appears on two public blocklists, confirming that defensive communities have recognized it as a phishing source. Automated analysis identified the presence of a website builder framework, client‑side scripting support, a live‑chat integration, and the enforcement of HTTP Strict Transport Security (HSTS). The observed page title matches the brand‑targeted credential lure, strengthening the attribution to a GoDaddy impersonation campaign.

Uncertainty remains around the exact phishing kit or any additional payloads delivered beyond the login prompt, as no visual or content inspection has been performed. Defenders should therefore block the domain at the network perimeter, add the associated IP address to threat intelligence feeds, and monitor for any DNS queries to the listed nameservers. Continuous re‑evaluation is advised, given the active status of the site and its ability to serve content over HTTPS.