metimaskloiigne[.]godaddysites[.]com

This domain, metimaskloiigne.godaddysites.com, is actively impersonating MetaMask, a cryptocurrency wallet service, as part of a crypto scam operation. Infrastructure analysis reveals the site is hosted on GoDaddy’s Website Builder platform, resolving to IP 13.248.243.5 (AS16509, Amazon.com, Inc., US). The domain is registered through GoDaddy.com, LLC, with nameservers cns1.secureserver.net and cns2.secureserver.net, and presents a valid SSL certificate issued by Go Daddy Secure Certificate Authority. The page title, 'Met𝖆mask | Login | Sign In,' uses Unicode substitution to evade basic detection, a common tactic in phishing campaigns targeting cryptocurrency users. The domain was created on November 18, 2013, though this registration date may not reflect its current malicious use, as subdomains on godaddysites.com are dynamically generated. It is currently flagged by two security blocklists (PhishDestroy, PhishingDB) and has a trust score of 0/100. Technologies detected include RequireJS and Re:amaze, which may be used for frontend functionality or customer engagement, though their specific role in this campaign remains unconfirmed. The site returns an HTTP 200 status, indicating it is operational and accessible. Defenders should note that this domain is part of a known brand impersonation scheme, specifically targeting MetaMask users. The use of a homoglyph in the page title suggests an attempt to bypass visual scrutiny. While 18 of 93 security vendors on VirusTotal have flagged this domain, the absence of detections from other vendors does not imply safety. Given the high-risk classification and active status, immediate blocking at the DNS or network level is recommended. Further analysis of the site’s content and backend infrastructure could provide additional indicators of compromise, though no login forms, redirect chains, or payload delivery mechanisms have been confirmed at this time.