mitamassk-looggin[.]godaddysites[.]com

PhishDestroy has identified mitamassk-looggin.godaddysites.com as an active crypto drainer phishing campaign specifically targeting MetaMask users. This domain is currently live and poses a high risk of credential theft and cryptocurrency theft. The site impersonates the legitimate MetaMask login page, tricking users into entering their seed phrases or private keys, which are then harvested by attackers.

Technical analysis reveals that this domain resolves to IP address 13.248.243.5 and was registered through GoDaddy.com, LLC. Its SSL certificate is issued by GoDaddy Secure Certificate Authority, lending a false sense of legitimacy. The domain was created on November 18, 2013, which is unusually old for a phishing site, but it remains active. On VirusTotal, 18 out of 95 security vendors flag this domain as malicious, and it appears on at least one security blocklist. The page title reads "Met𝓪Mask Login | Login | Signup," which is a direct attempt to mimic the official MetaMask interface.

Given the high risk and active status, users should avoid visiting this domain entirely. PhishDestroy recommends that any MetaMask user who may have interacted with this site immediately revoke permissions and transfer funds to a new wallet. Organizations should block access to this domain and educate users about verifying URLs before entering sensitive information. Report the domain to GoDaddy and relevant cybersecurity authorities to expedite takedown.