matte-muskk11lougn[.]godaddysites[.]com

The domain matte-muskk11lougn.godaddysites.com has been identified as a brand impersonation threat targeting MetaMask login credentials. Analysis indicates this domain operates under an elevated risk classification, specifically designed to mimic legitimate authentication portals. The current status of the domain is offline, though prior activity suggests it was actively used in credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on November 18, 2013, though recent malicious activity suggests potential compromise or repurposing. It resolves to the IP address 13.248.243.5, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). Detection metrics show 17 of 95 security vendors on VirusTotal flagged this domain for malicious activity, while it appears on two distinct security blocklists. The SSL certificate is issued by GoDaddy.com, Inc., which may lend an appearance of legitimacy despite the domain's fraudulent intent. The page title, '𝕄𝕖𝕥𝕒𝓂𝕒𝕤𝕜 𝕃𝕠𝕘𝕚𝕟 | 𝕊𝕚𝕘𝕟 𝕀𝕟,' further confirms its attempt to deceive users into disclosing sensitive information. Given the domain's current offline status, immediate threats appear mitigated; however, historical activity warrants caution. Organizations and individuals are advised to block access to the domain and its associated IP address (13.248.243.5) at the network level. Users who may have interacted with this domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Continuous monitoring of related infrastructure is recommended, as threat actors may re-establish operations under similar domains or IPs.