SafeMode - Analysis: mett-a-massk-loogiin.godaddysites.com

Captura Visual

Screenshot of mett-a-massk-loogiin.godaddysites.com

Información de Detección

http://mett-a-massk-loogiin.godaddysites.com/

Detected Brand

MetaMask

Country

International

Confianza

100%

HTTP Status

200

Report ID

032754a9-5d5…

Analyzed

2026-02-10 00:20

Final URL (after redirects)

https://mett-a-massk-loogiin.godaddysites.com/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T18F23E01271486AA5C2F349DD9510359060C7EB4EC97087B08A781E3B27F3AB537E9B7E
CONTENT ssdeep	768:ye3cxCKuzxq3yAzV0Hjkkmax/puyhVxzerBt8B1Ylutgp+G0c:ye3kuz/AzV0Hwkmax/puyhVGMttZGd

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9550ea35d32dd227
VISUAL aHash	cccc0e0e060603ff
VISUAL dHash	989cb83a983a6f0d
VISUAL wHash	eccc4e1e0e0603ff
VISUAL colorHash	07606000000
VISUAL cropResistant	bc89e9f961276567,989cb83a983a6f0d,cc8e8e3caea6ae27,06233212d3d3d3f2

Análisis de Código

Risk Score 76/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de MetaMask
• Método: Suplantación de identidad a través de un dominio similar en alojamiento gratuito
• Exfil: Desconocido, pero probablemente apunta a credenciales de inicio de sesión y/o frases semilla.
• Indicadores: Alojamiento gratuito, marca MetaMask, coincidencia de dominio.
• Riesgo: ALTO

🔒 Obfuscation Detected

fromCharCode
document.write

🎯 Kit Endpoints

https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~locale.en-US

📊 Desglose de Puntuación de Riesgo

Total Risk Score

95/100

Contributing Factors

Free Hosting

The site is hosted on a free hosting platform (godaddysites.com), a common tactic used in phishing campaigns.

Domain Impersonation

The domain name closely resembles the legitimate MetaMask brand to deceive users.

Obfuscation

Javascript obfuscation to evade detection.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

MetaMask users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
5 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

MetaMask

Official Website

https://metamask.io/

Fake Service

MetaMask login

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The attacker is using a look-alike domain with a login or sign-up page (probably hidden), to steal MetaMask user credentials (username/password or recovery seed phrases).