metamacslogi[.]wordpress[.]com

This domain, metamacslogi.wordpress.com, was identified as part of a wallet seed phishing campaign targeting MetaMask users. Infrastructure analysis reveals the domain was hosted on WordPress infrastructure, resolving to IP 192.0.78.12 (AS2635, Automattic, Inc., United States) with nameservers ns1.wordpress.com through ns4.wordpress.com. The page title, 'MetáMask Login | Log In to Account,' explicitly impersonates MetaMask, a cryptocurrency wallet service, aligning with the scam type classified as wallet/seed phishing. The domain was registered through MarkMonitor, Inc., on March 03, 2000, though this creation date predates typical phishing domain registration patterns and may reflect a repurposed or compromised legitimate domain. Technical indicators show the domain is currently offline, returning an HTTP 410 status code, which suggests intentional takedown or abandonment.

The SSL certificate was issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious sites due to its accessibility. Technologies detected include WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, consistent with standard WordPress hosting environments. The domain appears on one security blocklist, and 11 of 95 security vendors on VirusTotal flagged it as malicious, though the absence of additional context limits further assessment of detection efficacy. Defenders should treat this domain as part of confirmed phishing infrastructure.

The use of WordPress hosting, combined with the explicit MetaMask impersonation, indicates a deliberate attempt to harvest wallet credentials or seed phrases. While the domain is offline, historical DNS and WHOIS records should be preserved for forensic analysis. Organizations should monitor for related domains using similar naming conventions (e.g., 'metamask' misspellings or WordPress subdomains) and block access to this domain across security controls.