metamak-logi-us[.]godaddysites[.]com

This domain, metamak-logi-us.godaddysites.com, is identified as a crypto credential theft operation specifically designed to impersonate the MetaMask cryptocurrency wallet interface. The site presents a fraudulent login page titled 'Met𝖆mask | Login,' using Unicode spoofing to mimic the legitimate brand name. Analysis indicates the threat actor employed a homoglyph attack (replacing 'a' with U+1D566) to deceive users into entering sensitive wallet credentials, which are then harvested for unauthorized access or fund theft. No direct evidence of a drainer kit integration was observed, but the credential harvesting infrastructure aligns with known crypto-phishing campaigns targeting decentralized finance users. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. It was registered through a major domain registrar on November 18, 2013, though the phishing content appears to have been deployed recently. The SSL certificate is issued by a widely trusted certificate authority, which is consistent with phishing sites attempting to appear legitimate. VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious, while two independent security blocklists (PhishDestroy and PhishingDB) have listed it as a confirmed threat. No Google Safe Browsing (GSB) status was provided, but the elevated detection rate and blocklist presence confirm malicious intent. The domain has been taken offline, likely due to hosting provider intervention or registrar enforcement following abuse reports. While the immediate threat is neutralized, the infrastructure remains a residual risk. The original domain registration predates the phishing campaign by nearly a decade, suggesting either a compromised legitimate domain or a long-dormant registration repurposed for fraud. Users who interacted with the site should immediately revoke any active wallet sessions, rotate credentials, and monitor connected accounts for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address, while security teams should investigate potential credential reuse across other platforms. The use of homoglyphs and trusted hosting providers underscores the sophistication of this campaign, warranting continued vigilance against similar impersonation attempts.