usa-mettmssak-s0inin[.]godaddysites[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting MetaMask, a cryptocurrency wallet service. The site employs deceptive tactics, including homoglyphs in the page title (Metam𝐚sk Lo𝙜in), to trick users into disclosing sensitive login credentials or wallet recovery phrases. Analysis indicates this is not a generic phishing attempt but a targeted effort to compromise cryptocurrency assets by impersonating a trusted brand interface. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendor detections on VirusTotal report 19/95 flags, while the domain appears on at least one security blocklist. The SSL certificate is issued by GoDaddy.com, Inc., which does not mitigate the risk given the domain's fraudulent purpose. The use of a subdomain under godaddysites.com suggests an attempt to exploit perceived legitimacy while evading traditional domain reputation checks. Mitigation steps for this threat type include immediate blocking of the domain and IP at the network perimeter. Organizations should deploy homoglyph detection rules in email and web filtering systems to identify similar impersonation attempts. Users should be trained to verify domain authenticity by cross-referencing official brand URLs and inspecting page titles for Unicode manipulation. Cryptocurrency wallet holders are advised to enable hardware-based two-factor authentication and avoid entering recovery phrases on any site not explicitly linked from the official application or verified documentation. Incident responders should monitor for credential reuse patterns associated with this campaign.