mettha-mask-logi-in[.]godaddysites[.]com

This domain is a confirmed cryptocurrency credential theft site designed to harvest MetaMask wallet login details. Visitors are presented with a fake MetaMask login page that closely mimics the legitimate interface, tricking users into entering sensitive credentials such as seed phrases, passwords, or private keys. Once submitted, these credentials are captured by threat actors, enabling unauthorized access to victims' cryptocurrency wallets and potential financial loss through unauthorized transactions or asset theft. Analysis indicates this domain was registered on February 21, 2026, through GoDaddy.com, LLC, a common registrar for both legitimate and malicious sites. The domain resolves to IP address 76.223.105.230, hosted on Amazon Web Services infrastructure (AS16509). As of the latest scan, 18 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The page title, 'Meta𝒎ask Login | Met𝓪mask Sign in,' uses Unicode characters to obfuscate the fraudulent nature of the site, a tactic frequently employed to evade detection by users and automated security tools. If you visited mettha-mask-logi-in.godaddysites.com and entered any credentials or wallet information, immediately disconnect the device from the internet to prevent further data exfiltration. Revoke any active sessions associated with the MetaMask wallet and transfer all assets to a new, secure wallet using a different seed phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to your local cybersecurity authority or the legitimate MetaMask support team for further guidance. Reset all passwords and credentials that may have been exposed during the interaction with this site.