SafeMode - Analysis: mett-a-massk-loogiin.godaddysites.com

Visual Capture

Screenshot of mett-a-massk-loogiin.godaddysites.com

Detection Info

http://mett-a-massk-loogiin.godaddysites.com/

Detected Brand

MetaMask

Country

International

Confidence

100%

HTTP Status

200

Report ID

032754a9-5d5…

Analyzed

2026-02-10 00:20

Final URL (after redirects)

https://mett-a-massk-loogiin.godaddysites.com/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T18F23E01271486AA5C2F349DD9510359060C7EB4EC97087B08A781E3B27F3AB537E9B7E
CONTENT ssdeep	768:ye3cxCKuzxq3yAzV0Hjkkmax/puyhVxzerBt8B1Ylutgp+G0c:ye3kuz/AzV0Hwkmax/puyhVGMttZGd

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9550ea35d32dd227
VISUAL aHash	cccc0e0e060603ff
VISUAL dHash	989cb83a983a6f0d
VISUAL wHash	eccc4e1e0e0603ff
VISUAL colorHash	07606000000
VISUAL cropResistant	bc89e9f961276567,989cb83a983a6f0d,cc8e8e3caea6ae27,06233212d3d3d3f2

Code Analysis

Risk Score 76/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: MetaMask users
• Method: Impersonation through a look-alike domain on free hosting
• Exfil: Unknown, but likely targets login credentials and/or seed phrases.
• Indicators: Free hosting, MetaMask branding, domain mismatch.
• Risk: HIGH

🔒 Obfuscation Detected

fromCharCode
document.write

🎯 Kit Endpoints

https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~locale.en-US

📊 Risk Score Breakdown

Total Risk Score

95/100

Contributing Factors

Free Hosting

The site is hosted on a free hosting platform (godaddysites.com), a common tactic used in phishing campaigns.

Domain Impersonation

The domain name closely resembles the legitimate MetaMask brand to deceive users.

Obfuscation

Javascript obfuscation to evade detection.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

MetaMask users (International)

Attack Method

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
5 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

MetaMask

Official Website

https://metamask.io/

Fake Service

MetaMask login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker is using a look-alike domain with a login or sign-up page (probably hidden), to steal MetaMask user credentials (username/password or recovery seed phrases).