meetamaskllogin[.]wordpress[.]com

The domain meetamaskllogin.wordpress.com was observed hosting a credential‑harvesting page that explicitly references MetaMask in its page title “MetáMask Login | Sig In”. The site is registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, yet the registration date of March 03 2000 predates the emergence of the MetaMask wallet, indicating that the domain was likely repurposed for malicious use. Infrastructure analysis shows the domain resolves to IP address 192.0.78.13, an address owned by Automattic, Inc. (AS2635) located in the United States and typically used for WordPress.com hosting. The domain employs a Let’s Encrypt certificate issued under the “E8” profile, and HTTP requests return a 410 Gone status, suggesting the content has been removed or taken offline.

Despite the offline status, the domain was listed on one security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans recorded ten detections out of ninety‑five scanners, providing additional evidence of malicious classification. Technology fingerprints reveal a standard WordPress stack – WordPress, MySQL, PHP, Nginx – with security‑enhancing features such as HSTS and HTTP/3 enabled. The nameservers ns1‑ns4.wordpress.com further confirm hosting on the WordPress.com platform.

The available intelligence classifies the campaign as a wallet/seed phishing operation targeting MetaMask users. No additional indicators, such as malicious payload hashes or command‑and‑control endpoints, have been disclosed. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the site, and add the observed indicators (IP 192.0.78.13, TLS certificate details, and the specific page title) to threat‑intel feeds.