metamaslklogin[.]wordpress[.]com

Analysis of metamaslklogin.wordpress.com indicates this domain was actively impersonating MetaMask, a cryptocurrency wallet service, as part of a wallet and seed-phishing operation. The domain, hosted on WordPress infrastructure, was flagged by eight of ninety-five security vendors on VirusTotal, though no further details on specific detection engines are available. It appeared on at least one security blocklist (PhishDestroy) and was assigned an elevated risk level before being taken offline. The page title, 'MetáMask Login | Log In to Account,' closely mimics MetaMask’s official branding, with a subtle character substitution (accented 'a') likely intended to evade casual detection. Infrastructure analysis reveals the domain resolved to 192.0.78.13, an IP address assigned to Automattic, Inc. (AS2635) in the United States, and was served over Nginx with HTTP/3 and HSTS enabled.

The site returned an HTTP 410 status code at the time of assessment, indicating it was intentionally removed or disabled. The domain was registered through MarkMonitor, Inc. on March 3, 2000, though this registration date predates the phishing activity and likely reflects a repurposed or compromised WordPress subdomain rather than a newly registered malicious domain. SSL certification was provided by Let’s Encrypt (serial number E8), consistent with automated certificate issuance on WordPress-hosted sites. While the domain is no longer accessible, defenders should treat any prior interaction with it as a potential compromise of wallet credentials or seed phrases.

Given the use of a legitimate hosting provider (WordPress) and valid SSL, users may have been less likely to recognize the site as fraudulent. Organizations monitoring for brand impersonation should include this domain in retrospective threat-hunting queries, particularly for MetaMask-related phishing campaigns. No evidence of additional payload delivery or secondary infrastructure (e.g.