methasin43-massklogg[.]godaddysites[.]com

This domain is flagged as a high-risk brand impersonation threat targeting MetaMask users, specifically designed for credential theft or crypto wallet compromise. Analysis indicates the infrastructure was constructed to mimic legitimate MetaMask authentication portals, as evidenced by the page title 'Met𝓪Mask Login | Login | Signup,' which employs Unicode obfuscation to evade detection. The domain presents a significant risk to users due to its deceptive design and association with known phishing campaigns targeting cryptocurrency assets.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, a common feature in phishing sites to appear legitimate. The domain is currently offline but was previously detected by 19 out of 95 security vendors on VirusTotal and appears on four security blocklists, including PhishDestroy, MetaMask’s internal systems, SEAL, and PhishingDB. These indicators confirm its malicious intent and widespread recognition as a threat.

Mitigation steps for this specific threat type include immediate blacklisting of the domain and associated IP address within enterprise security systems. Organizations should deploy automated detection rules to identify Unicode obfuscation in page titles or URLs, particularly those targeting MetaMask or other cryptocurrency wallet brands. End users should be educated on verifying domain authenticity, avoiding links from unsolicited communications, and using hardware-based or multi-factor authentication for wallet access. Incident response teams should monitor for credential reuse or unauthorized transactions linked to this campaign, as stolen credentials may be leveraged in secondary attacks.