metamaskwalletloginn[.]wordpress[.]com

This domain, metamaskwalletloginn.wordpress.com, is identified as a brand_impersonation phishing site targeting MetaMask, a cryptocurrency wallet service. The domain is currently offline but was previously active in malicious operations designed to deceive users into disclosing sensitive credentials or financial information by mimicking the official MetaMask login interface. Analysis indicates the domain was flagged by 11 of 95 security vendors on VirusTotal, reflecting a moderate-to-high detection rate. It was registered through MarkMonitor, Inc., and resolved to the IP address 198.18.3.50, hosted under AS2635 (Automattic, Inc) in the United States. The domain was created on March 03, 2000, though its malicious use likely occurred much later. It appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate was issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing infrastructure. The page title, '| Metamask wallet login | – metamask wallet login,' further confirms its intent to impersonate the legitimate MetaMask service. The domain is currently offline, reducing immediate risk, but its infrastructure and historical activity warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP (198.18.3.50) at the network level. Security teams should review logs for connections to this domain or IP, particularly from March 2023 onward, and alert affected users. MetaMask users should verify the authenticity of login pages by checking the URL and SSL certificate details before entering credentials. Additionally, enabling multi-factor authentication (MFA) on cryptocurrency wallets can mitigate the impact of credential theft.