metha-mask-lojgin[.]godaddysites[.]com

Analysis indicates that metha-mask-lojgin.godaddysites.com is a credential‑phishing site that leverages brand impersonation of GoDaddy. The site’s registered title, “Meta𝒎ask Login | Met𝓪mask,” suggests an attempt to lure users of the MetaMask wallet, yet the declared brand target is GoDaddy, confirming a mixed‑brand tactic. The domain was created on 18 Nov 2013 and is hosted on Amazon’s AS16509 network, resolving to 13.248.243.5 in the United States. DNS resolution uses GoDaddy’s cns1.secureserver.net and cns2.secureserver.net name servers, and the TLS certificate is issued by Go Daddy Secure Certificate Authority – G2, a certificate normally associated with legitimate GoDaddy services.

Despite the legitimate‑looking certificate, the site returns an HTTP 404 status and has been taken offline, indicating that the phishing page is no longer actively served. Threat intelligence shows that 16 of 95 VirusTotal scanners flag the domain, and Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a credential‑phishing vector. Technologies identified on the site include GoDaddy Website Builder, RequireJS, Cloudflare, Re:amaze, HSTS, and cdnjs, all of which are common in legitimate constructions but do not mitigate the phishing risk.

Defenders should continue to block the domain at network perimeter and DNS layers, add its IP address 13.248.243.5 to any relevant deny lists, and monitor for re‑use of the same hosting infrastructure. Because the SSL certificate is issued by a trusted GoDaddy authority, reliance on certificate validation alone is insufficient; correlation with the observed page title and blocklist entries is required. Ongoing surveillance of related GoDaddy‑builder subdomains is advised to detect potential re‑deployment of the impersonation campaign.