metamasskwallet[.]wordpress[.]com

Analysis of metamasskwallet.wordpress.com indicates a high‑risk brand‑impersonation campaign targeting Ethereum users. The domain resolves to IP 192.0.78.12, which belongs to AS2635 Automattic, Inc. and is geolocated in the United States. Registration information shows the domain was created on 3 March 2000 and is registered through MarkMonitor, Inc. The site is hosted on WordPress.com infrastructure, using the standard nameservers ns1.wordpress.com, ns2.wordpress.com, ns3.wordpress.com, ns4.wordpress.com and presents a Let’s Encrypt certificate (E8). Page metadata contains the title “MetάMάsk Wάllet – A crypto wallet & gateway to blockchain apps”, reinforcing the cryptocurrency‑related lure. Security telemetry shows the domain is listed on a single blocklist, has been blocked by PhishDestroy, and is flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category. VirusTotal reports eight detections out of ninety‑five scanners, confirming malicious intent. The HTTP response returns status 200 and the site advertises technologies such as WordPress, MySQL, PHP, Nginx, HSTS, Google Publisher Tag and Google Analytics. Given the combination of brand impersonation, active hosting, and multiple security vendor detections, defenders should consider the domain malicious, enforce network‑level blocking, monitor DNS queries for the domain and its IP, and advise users to avoid any interaction with the site. Further investigation of the hosted content is recommended to determine the specific phishing vectors employed.