metta-maske-logyz[.]godaddysites[.]com

The domain metta-maske-logyz.godaddysites.com was registered on 18 Nov 2013 through GoDaddy.com, LLC and continues to resolve to the IPv4 address 13.248.243.5. The host is served from Amazon’s AS16509 network in the United States and presents a GoDaddy‑issued SSL certificate (GoDaddy.com, Inc. / Go Daddy Secure Certificate Authority – G2). DNS resolution uses GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net, and the site returns HTTP 200 for the root URL.

Static analysis shows the site is built with GoDaddy Website Builder and incorporates RequireJS and HSTS headers. The page title observed is “Met𝓪Mask Login | Login”, indicating an attempt to masquerade as a login portal. VirusTotal has flagged the domain in 19 of 95 scanned security engines, and the domain appears on two public phishing blocklists (PhishDestroy and PhishingDB). Gridinsoft assigns a trust score of 0/100, further confirming malicious intent.

Threat intelligence classifies the activity as credential phishing targeting the GoDaddy brand, and the risk rating is high. The infrastructure is modest—a single IP address and standard GoDaddy hosting—yet the use of a legitimate SSL certificate and active HSTS may increase user trust. No additional payloads, command‑and‑control endpoints, or post‑exploitation behavior have been observed, leaving the precise phishing workflow undocumented.

Defenders should prioritize blocking the domain and its resolved IP at perimeter and DNS layers. Continuous monitoring of DNS queries for the domain and related subdomains is advised, as the attacker may reuse the same hosting environment for future campaigns. Incident responders should alert end users to the fake GoDaddy login attempt and enforce multi‑factor authentication for any GoDaddy accounts. Threat hunters may consider correlating recent login failures against the IP address 13.248.243.5 to identify compromised credentials.