mmetamascologinn[.]wordpress[.]com

The domain mmetamascologinn.wordpress.com was observed hosting a page titled “MetáMask Login | Log In to Account,” explicitly referencing the MetaMask brand. The page title, combined with the listed brand target of MetaMask and the classification of wallet/seed phishing, indicates a deliberate attempt to harvest cryptocurrency wallet credentials. Technical analysis shows the domain resolves to IP address 192.0.78.12, which is allocated to AS2635 Automattic, Inc., the operator of the WordPress.com hosting platform. The server presents a Let’s Encrypt certificate (issuer E8) and supports modern protocols such as HTTP/3, HSTS, and Nginx. The HTTP response code returned is 410, indicating the resource has been removed and is no longer available.

VirusTotal records show that 7 of 95 scanned security vendors flagged the domain as malicious, and the domain is currently listed on one external blocklist. PhishDestroy has also taken the domain offline. The domain’s authoritative name servers are the standard WordPress.com set (ns1‑ns4.wordpress.com). Registration information reveals the domain was created on 03 March 2000 and is managed through MarkMonitor, Inc., a registrar commonly used for brand protection.

The risk rating is elevated, reflecting the targeted nature of the impersonation. Although the site is presently offline, the infrastructure components—WordPress hosting, a generic Let’s Encrypt certificate, and a previously registered domain—demonstrate a low barrier to re‑deployment. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for new subdomains that reference MetaMask or similar wallet services, and consider adding the IP address 192.0.78.12 to reputation lists. Ongoing vigilance is advised, as the underlying hosting environment could be reused for future credential‑harvesting campaigns targeting cryptocurrency users.