SafeMode - Analysis: mett-a-massk-loogiin.godaddysites.com

Captura Visual

Screenshot of mett-a-massk-loogiin.godaddysites.com

Informações de Detecção

http://mett-a-massk-loogiin.godaddysites.com/

Detected Brand

MetaMask

Country

International

Confiança

100%

HTTP Status

200

Report ID

032754a9-5d5…

Analyzed

2026-02-10 00:20

Final URL (after redirects)

https://mett-a-massk-loogiin.godaddysites.com/

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T18F23E01271486AA5C2F349DD9510359060C7EB4EC97087B08A781E3B27F3AB537E9B7E
CONTENT ssdeep	768:ye3cxCKuzxq3yAzV0Hjkkmax/puyhVxzerBt8B1Ylutgp+G0c:ye3kuz/AzV0Hwkmax/puyhVGMttZGd

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9550ea35d32dd227
VISUAL aHash	cccc0e0e060603ff
VISUAL dHash	989cb83a983a6f0d
VISUAL wHash	eccc4e1e0e0603ff
VISUAL colorHash	07606000000
VISUAL cropResistant	bc89e9f961276567,989cb83a983a6f0d,cc8e8e3caea6ae27,06233212d3d3d3f2

Análise de Código

Risk Score 76/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Usuários MetaMask
• Método: Imitação por meio de um domínio semelhante em hospedagem gratuita
• Exfil: Desconhecido, mas provavelmente visa credenciais de login e/ou frases semente.
• Indicadores: Hospedagem gratuita, marca MetaMask, incompatibilidade de domínio.
• Risco: ALTO

🔒 Obfuscation Detected

fromCharCode
document.write

🎯 Kit Endpoints

https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~locale.en-US

📊 Detalhamento da Pontuação de Risco

Total Risk Score

95/100

Contributing Factors

Free Hosting

The site is hosted on a free hosting platform (godaddysites.com), a common tactic used in phishing campaigns.

Domain Impersonation

The domain name closely resembles the legitimate MetaMask brand to deceive users.

Obfuscation

Javascript obfuscation to evade detection.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

MetaMask users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
5 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

MetaMask

Official Website

https://metamask.io/

Fake Service

MetaMask login

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The attacker is using a look-alike domain with a login or sign-up page (probably hidden), to steal MetaMask user credentials (username/password or recovery seed phrases).