methiamsakloghiehn[.]wordpress[.]com

The domain methiamsakloghiehn.wordpress.com was created on 2000-03-03 and is registered through MarkMonitor, Inc. It uses the standard WordPress.com nameservers ns1‑ns4.wordpress.com and resolves to the IP address 192.0.78.13, which belongs to AS2635 Automattic, Inc. in the United States. The site served content over HTTPS with a Let’s Encrypt certificate (entity E8) and employed WordPress, MySQL, PHP, Nginx, HSTS and HTTP/3. The page title observed, “Metamask® login – Metamask® Extension – Managing my Wallet.

Resetting, Deleting”, explicitly references the MetaMask brand, indicating a brand‑impersonation crypto‑scam. VirusTotal analysis recorded nine detections out of ninety‑five scanners, and the domain is listed on a single public blocklist and is currently blocked by PhishDestroy. HTTP responses return a 410 Gone status, confirming the site is offline.

The combination of a legitimate hosting provider, a valid TLS certificate, and a page title that mimics a popular cryptocurrency wallet suggests the operator attempted to leverage trusted infrastructure to increase credibility. Defenders should continue to block the domain at network and endpoint layers, monitor for newly registered subdomains on the same nameservers, and consider adding the domain to internal threat intel feeds. Because the site is already offline, no immediate remediation of active traffic is required, but the presence of brand‑impersonation activity warrants heightened vigilance for similar campaigns targeting MetaMask or other crypto‑related services.