meetamasklogen[.]wordpress[.]com

The domain meetamasklogen.wordpress.com was observed delivering a MetaMask brand impersonation campaign, as indicated by the page title "ḾétáMásk Login : Buy, Send ánd Swap". DNS resolution points to the WordPress‑hosted infrastructure operated by Automattic (AS2635, United States) with nameservers ns1‑ns4.wordpress.com and the IP address 192.0.78.13. The site employed a Let’s Encrypt certificate (identifier E8) and served over HTTPS with HSTS and HTTP/3 enabled. Technology fingerprints reveal a standard WordPress stack running MySQL, PHP and Nginx.

The domain is registered through MarkMonitor, Inc., a registrar commonly used for brand‑protected domains, suggesting the attacker leveraged a legitimate registration channel. The domain was created on 03 Mar 2000, but the malicious content likely appeared much later, as evidenced by its classification as a crypto‑related scam targeting MetaMask users. VirusTotal scans reported eight of ninety‑five security vendors flagging the domain, and the domain appears on one external blocklist.

PhishDestroy has already taken the site offline, returning an HTTP 410 Gone status. Defenders should immediately block meetamasklogen.wordpress.com at perimeter and endpoint filters, add the host to internal URL reputation lists, and monitor the associated IP range (192.0.78.0/24) for any re‑use. Continuous observation of WordPress‑hosted domains that exhibit brand‑specific titles or meta‑tags is advised, as the underlying infrastructure can be repurposed for new impersonation campaigns.