meta-mask-loogiss[.]godaddysites[.]com

This domain, meta-mask-loogiss.godaddysites.com, is currently offline but retains a full set of indicators consistent with a high‑risk brand‑impersonation campaign targeting MetaMask users. The site was registered through GoDaddy.com, LLC on 18 Nov 2013 and continues to resolve to the Amazon Web Services address 76.223.105.230 (AS16509, United States). The hosting infrastructure is a GoDaddy Website Builder instance protected by HSTS and loading RequireJS, suggesting a low‑cost, template‑based deployment. The TLS certificate is issued by Go Daddy Secure Certificate Authority – G2 and matches the domain, confirming that the attacker obtained a legitimate certificate via the registrar’s automated issuance process.

A page title retrieved from the host reads “Met𝓪Mask Login | Login | Signup”, directly invoking the MetaMask brand. The HTTP response is a 404 status, indicating the landing page has been removed, yet the domain remains listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask’s own protection service, and SEAL. VirusTotal scans flag the domain on 19 of 95 engines, reinforcing the malicious classification. The campaign is identified as a crypto‑scam, consistent with the brand’s association with cryptocurrency wallets.

Defenders should continue to block the domain at perimeter and endpoint layers, monitor DNS queries for the IP 76.223.105.230, and update any URL filtering policies to include the observed host. Because the site is hosted on a shared AWS address, additional malicious actors could reuse the same IP, so correlation with other suspicious domains is advised. Analysts should also watch for new subdomains under godaddysites.com that mimic the MetaMask brand, and consider sharing the indicator set with threat‑intel communities to accelerate detection. Until the domain is definitively taken down, the presence of a valid SSL certificate and the brand‑specific page title remain the primary evidence of intent.