metaamask-llggion[.]godaddysites[.]com

The domain metaamask-llggion.godaddysites.com has been identified as a brand impersonation phishing site specifically targeting MetaMask users. This site attempts to deceive visitors by mimicking the legitimate MetaMask platform, aiming to steal login credentials, seed phrases, or other sensitive cryptocurrency-related information. The threat type is classified as generic phishing with an elevated risk level, and it may have been associated with a crypto drainer kit designed to empty victims' wallets.

Technical analysis reveals that the domain resolves to IP address 76.223.105.230 and was created on November 18, 2013, through GoDaddy.com, LLC. It currently shows a 404 Not Found page, indicating it has been taken offline. The SSL certificate is issued by GoDaddy Secure Certificate Authority G2, which is typical for sites hosted on GoDaddy. VirusTotal reports that 5 out of 95 security vendors flag this domain as malicious, and it appears on 3 security blocklists. Google Safe Browsing (GSB) status is not explicitly provided, but the presence on multiple blocklists suggests it was previously active.

The current status of the domain is offline, likely due to security vendor takedown efforts or administrative action. However, remaining risk exists as the domain could be reactivated or similar domains may appear. Users should avoid any interaction with this domain or any unsolicited communications referencing it. PhishDestroy recommends enabling two-factor authentication on all cryptocurrency accounts, never entering seed phrases on any website, and reporting any suspicious domains to security authorities.