matamask-llogiezx[.]godaddysites[.]com

The domain matamask-llogiezx.godaddysites.com has been identified as a brand_impersonation threat targeting MetaMask. Analysis confirms the domain is currently offline but previously hosted a fraudulent login page titled 'Meta𝓶ask Login | Sign In.' This infrastructure was designed to deceive users into disclosing credentials by mimicking the legitimate MetaMask cryptocurrency wallet service. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolved to the IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate was issued by Go Daddy Secure Certificate Authority - G2, a common certificate provider for both legitimate and malicious sites. Security vendors flagged this domain as malicious, with 19 out of 95 VirusTotal engines detecting it. Additionally, the domain appeared on one security blocklist, further indicating its use in phishing operations. The page title included Unicode characters to evade basic detection mechanisms, a tactic observed in other credential-harvesting campaigns. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure and tactics employed suggest the operators may attempt to reestablish similar domains. Organizations and users are advised to monitor for domains impersonating MetaMask, particularly those using Unicode obfuscation in page titles or hosted on consumer-grade website builders. Network defenders should block the IP address 13.248.243.5 and domains registered through the same pattern. End users should verify the legitimacy of MetaMask-related communications by accessing the official website directly and avoiding links from unsolicited messages.