metaamaskkloggin[.]wordpress[.]com

Analysis of metaamaskkloggin.wordpress.com shows a high‑risk brand‑impersonation campaign targeting MetaMask users. The site was created on March 03, 2000 and is hosted on infrastructure owned by Automattic, Inc. (AS2635) with the resolved address 192.0.78.12, a US‑based server that also serves legitimate WordPress sites. The domain resolves to the standard WordPress nameservers ns1‑ns4.wordpress.com, runs WordPress on a stack that includes MySQL, PHP, Nginx, HSTS and HTTP/3, and presents a Let’s Encrypt certificate (E8). The HTTP response code is 410, indicating that the content has been removed, and the current status is listed as offline.

Despite being taken offline, the domain has been recorded on one security blocklist and was blocked by PhishDestroy. Google Safe Browsing flags the site for social engineering, and VirusTotal reports that 15 of 95 scanned security vendors flagged the domain as malicious. The page title "MétaMaśk Login | login in to account" explicitly references the MetaMask brand, confirming the intent to impersonate the cryptocurrency wallet service. Registration details show the domain was acquired through MarkMonitor, Inc., a registrar commonly used for legitimate brand protection, suggesting the registration may have been spoofed or compromised.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑hosting attempts. Because the site is offline, active mitigation focuses on preventing reuse of the same domain or similar look‑alike names. Continuous observation of the IP address and associated hosting provider is advised, as legitimate WordPress hosting could be leveraged for future malicious deployments. Uncertainty remains regarding the original source of the phishing kit and whether the domain will be resurrected; threat intel teams should treat any future resolution of this hostname as suspicious and apply appropriate containment measures.