motamsk-mask-lgginlogi[.]godaddysites[.]com

This domain, motamsk-mask-lgginlogi.godaddysites.com, is identified as a brand impersonation resource specifically targeting MetaMask, a widely used cryptocurrency wallet service. The site presents a fraudulent login interface, mimicking the legitimate MetaMask authentication portal with the page title 'Met𝓪Mask Login | Login.' Analysis indicates the presence of a credential harvesting mechanism, likely designed to capture sensitive user data such as wallet seed phrases or private keys, which could lead to unauthorized asset transfers or account takeovers. Technical indicators confirm the domain's malicious nature. The resource is flagged by 20 out of 95 security vendors on VirusTotal, reflecting a consensus on its harmful intent. It was registered through GoDaddy.com, LLC, and resolves to the IP address 13.248.243.5, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain was created on February 21, 2026, though this date may reflect spoofed registration metadata. It appears on one security blocklist and is associated with an SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. Notably, the domain has not been listed on Google Safe Browsing at the time of analysis. As of the latest assessment, the domain has been taken offline, likely following detection and reporting by security entities such as PhishDestroy. However, the elevated risk persists due to the potential for similar domains to emerge using comparable infrastructure or registration patterns. Users who may have interacted with this domain are advised to immediately revoke any active sessions, rotate credentials, and monitor associated accounts for unauthorized activity. Organizations should update detection rules to include this domain and its technical indicators, while also scrutinizing newly registered domains with similar naming conventions or hosting providers.