metanasklogin[.]wordpress[.]com

On July 23 2026 the domain metanasklogin.wordpress.com was observed returning HTTP 410 Gone, indicating the content has been removed. The site was hosted on the WordPress.com infrastructure (nameservers ns1‑ns4.wordpress.com) and resolved to IP 192.0.78.12, an address owned by AS2635 Automattic, Inc., United States. The TLS certificate was issued by Let’s Encrypt (certificate label “E8”), confirming the use of a free SSL provider rather than a brand‑specific certificate. VirusTotal recorded nine detections out of ninety‑five scanned scanners, and the domain appears on a single public blocklist (PhishDestroy).

Registration data shows the domain was created on 3 March 2000 and was registered through MarkMonitor, Inc., a registrar commonly used for brand‑protected domains. The page title retrieved prior to takedown read “© 2022 metamask login – Ḿetamask Login”, and the site advertised a “Crypto Scam” type, explicitly impersonating the MetaMask brand. Automated fingerprinting identified WordPress, MySQL, PHP, Nginx, HSTS and HTTP/3 as the underlying technologies. The combination of a brand‑specific page title, the MetaMask impersonation claim, and the crypto‑related classification suggests an attempt to harvest cryptocurrency wallet credentials or lure users into installing malicious extensions.

Although the site is currently offline, the infrastructure – shared WordPress hosting, a generic Let’s Encrypt certificate, and a public IP address belonging to Automattic – may be reused for future campaigns. Defenders should continue to block the domain at DNS and proxy layers, monitor for similar sub‑domains on the same hosting pool, and update endpoint protection rules to flag any outbound connections to IP 192.0.78.12 that originate from applications handling cryptocurrency wallets.