mi-etta-mask-logjin[.]godaddysites[.]com

This domain, mi-etta-mask-logjin.godaddysites.com, poses a brand impersonation threat specifically targeting cryptocurrency users by presenting a fraudulent MetaMask login interface. The page title, "Met𝓪Mask Login | Login | Signup," uses Unicode characters to obfuscate the fake login portal, a common tactic to evade detection while tricking users into entering credentials. Analysis indicates the domain is designed to harvest login details, which could lead to unauthorized access to cryptocurrency wallets or other sensitive accounts. The inclusion of "MetaMask" in the title and URL suggests a focus on users of the popular Ethereum wallet, increasing the likelihood of successful credential theft or subsequent crypto drainer attacks. Evidence supporting the malicious nature of this domain includes detection by 16 out of 95 security vendors on VirusTotal, indicating a consensus among multiple threat intelligence sources. The domain was registered through GoDaddy.com, LLC on November 18, 2013, though the subdomain infrastructure appears to have been repurposed for phishing. It resolves to the IP address 76.223.105.230, hosted on Amazon.com, Inc. (AS16509) in the United States. The domain is currently listed on two security blocklists and has been blocked by PhishDestroy and PhishingDB. The SSL certificate is issued by GoDaddy.com, Inc., which, while legitimate, does not mitigate the domain's fraudulent intent. The domain has since been taken offline, but its infrastructure remains a documented part of phishing campaigns. Users who visited mi-etta-mask-logjin.godaddysites.com should assume their credentials or other sensitive information may have been compromised. Immediate actions include resetting passwords for any accounts accessed through the site, particularly cryptocurrency wallets or financial services. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized transactions or login attempts. If cryptocurrency wallets were accessed, consider transferring assets to a new wallet with a fresh seed phrase. Report the incident to relevant platforms, such as the cryptocurrency exchange or wallet provider, and consider filing a report with local cybersecurity authorities or organizations that track phishing infrastructure.