metamaskchrome[.]wordpress[.]com

This domain, metamaskchrome.wordpress.com, is registered through MarkMonitor, Inc., a registrar commonly used by trademark owners. The sub‑domain resolves to 192.0.78.12, an address owned by AS2635 Automattic, Inc. in the United States, indicating that the site is hosted on the WordPress.com platform. The server presents a Let’s Encrypt certificate (issuer E8) and responds with HTTP status 410, meaning the content has been removed. Technology fingerprints show WordPress, MySQL, PHP, Nginx, HSTS and HTTP/3, all typical of a standard WordPress.com deployment.

VirusTotal reports four detections out of ninety‑five scanning engines, and the domain appears on one public blocklist and is listed by PhishDestroy, confirming that security vendors have identified malicious use. The page title returned is “Site Title”, which provides no additional context. The domain was created on 3 March 2000, a date far earlier than the observed malicious activity, suggesting the name was likely repurposed for a recent crypto‑related campaign.

The threat profile specifies brand impersonation of MetaMask and classifies the activity as a crypto scam. While the site is currently offline, the combination of registrar, hosting, SSL, detection counts, and blocklist listings provides sufficient evidence for defenders to treat the domain as hostile. Mitigation recommendations include adding the domain to network blocklists, monitoring for future DNS resolution changes, and reviewing any email or web traffic that references the domain for potential credential‑stealing attempts.