meramaskhlogin[.]wordpress[.]com

Analysis of meramaskhlogin.wordpress.com indicates a confirmed brand-impersonation threat targeting MetaMask users, classified as a crypto scam. The domain, hosted on WordPress infrastructure, was taken offline following detection, with an HTTP 410 status confirming its removal. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on March 3, 2000, though this registration date may reflect an administrative placeholder rather than active malicious use at the time. The site resolved to IP 192.0.78.12, operated by Automattic, Inc. (AS2635) in the United States, and employed standard WordPress technologies including Nginx, PHP, MySQL, and HSTS enforcement. A Let's Encrypt SSL certificate (serial E8) was present, providing encrypted connections without indicating legitimacy.

The page title, 'MetaMask | Login | Sign In To Account,' explicitly signals intent to deceive users into believing they are accessing the official MetaMask login portal. Seven of 95 security vendors on VirusTotal flagged the domain as malicious, while PhishDestroy explicitly blocked it, and the domain appears on at least one security blocklist. No additional threat intelligence from Safe Browsing or OTX was provided in the available data. The use of WordPress nameservers (ns1.wordpress.com through ns4.wordpress.com) suggests the attackers leveraged a legitimate hosting platform to deploy the scam, a common tactic to evade initial detection. Defenders should treat this domain as a confirmed phishing endpoint.

While the site is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis. Organizations are advised to block the domain and its resolved IP at the network level, update endpoint protection rules to flag any future resolutions, and alert users to the specific MetaMask impersonation tactic.