metamsdflogin[.]wordpress[.]com

Analysis of metamsdflogin.wordpress.com indicates that the sub‑domain is being used for credential phishing targeting MetaMask users. The page title returned when the site was reachable was “MetáMask Login | Log In to Account”, which directly references the MetaMask brand and suggests a credential‑harvesting page. The domain resolves to IP 192.0.78.13, an address owned by Automattic, Inc. (AS2635) and hosted in the United States. The host infrastructure runs WordPress with MySQL, PHP, Nginx, HSTS and HTTP/3 enabled, consistent with a typical WordPress deployment.

The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a publicly trusted certificate. The nameservers are the standard Wordpress.com set (ns1‑ns4.wordpress.com). The domain was created on 3 March 2000 and is registered through MarkMonitor, Inc., a registrar commonly used for legitimate brands, which suggests the sub‑domain was deliberately created for this malicious campaign rather than being a newly registered throwaway. VirusTotal reports that 10 of 95 scanned security vendors flagged the domain, and at least one external blocklist (PhishDestroy) is already actively blocking it.

HTTP status 410 indicates the content has been removed, and the current offline status confirms the site is no longer serving pages. Uncertainty remains regarding the specific phishing kit or any additional command‑and‑control infrastructure, as no further artefacts such as malicious scripts or redirect chains have been observed. Defenders should continue to block the IP address 192.0.78.13 and the full sub‑domain, add the domain to internal URL filtering lists, and monitor for any re‑appearance under alternative sub‑domains on the same hosting provider.