mett-amuske-olglin[.]godaddysites[.]com

This domain, mett-amuske-olglin.godaddysites.com, is flagged as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. The site mimics the official MetaMask login interface to deceive users into entering sensitive credentials, such as wallet recovery phrases or private keys. Such attacks are designed to facilitate unauthorized access to cryptocurrency holdings, leading to potential financial loss or identity compromise. The page title, "𝐌𝐞𝐭𝓪𝐌𝐚𝐬𝐤 𝐋𝐨𝐠𝐢𝐧 | 𝐋𝐨𝐠𝐢𝐧 | 𝐒𝐢𝐠𝐧𝐮𝐩," closely resembles legitimate MetaMask branding, increasing the likelihood of successful deception.

Analysis indicates this domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 13.248.243.5, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain is currently offline, but at the time of detection, it was flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious nature. Additionally, the domain appears on two security blocklists and is associated with a GoDaddy-issued SSL certificate, which may lend a false sense of legitimacy to unsuspecting users. The use of a third-party hosting service and a reputable registrar is a common tactic to evade initial detection.

If a user visited this domain or entered credentials, immediate action is required to mitigate risk. First, revoke any active sessions linked to MetaMask or associated wallets and transfer funds to a new, secure wallet address. Enable multi-factor authentication on all accounts where possible and monitor for unauthorized transactions. Users should also scan their devices for malware, as credential theft sites may deploy additional payloads. Report the incident to the legitimate service provider (MetaMask) and consider filing a complaint with relevant cybersecurity authorities to aid in tracking and takedown efforts.