metamaskuo[.]wordpress[.]com

This domain, metamaskuo.wordpress.com, is flagged as a brand impersonation threat targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the site mimics the official MetaMask login interface, presenting itself as the 'MetaMask Login Extension – Official Site – Meta-Mask Login' to deceive users into entering sensitive credentials. The domain does not appear to host a known drainer kit but operates as a credential harvester, likely funneling stolen data to threat actors for financial exploitation. Technical indicators reveal the domain was registered on March 03, 2000, though this date may reflect a falsified or inherited registration record. It resolves to IP address 198.18.3.53 and is hosted on infrastructure utilizing WordPress, MySQL, PHP, and Nginx, with HSTS and HTTP/3 enabled. The domain is registered through MarkMonitor, Inc., and employs a Let's Encrypt SSL certificate. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist and was previously blocked by at least one anti-phishing system. As of the latest assessment, metamaskuo.wordpress.com has been taken offline, reducing immediate risk to end users. However, the infrastructure may remain under threat actor control, and the domain could resurface under a different configuration. Users who interacted with the site should assume credential compromise and take immediate action, including password resets and wallet key rotation. Organizations should monitor for related indicators, such as the resolving IP and SSL certificate patterns, to preemptively block similar threats.