metamasklogimn[.]wordpress[.]com

metamasklogimn.wordpress.com was observed hosting a credential‑collection page that mimics MetaMask login flows. The page title returned by the server is “MetaMásk Login | Log In to My Ãccount – Metamask login”, confirming the intent to impersonate the MetaMask brand. VirusTotal records indicate that 14 of 95 scanning engines flagged the domain, demonstrating a moderate level of detection across the security community. The domain resolves to 192.0.78.12, an IP address owned by Automattic, Inc. (AS2635) located in the United States, and is served through the standard WordPress hosting stack (Nginx, PHP, MySQL) with HSTS and HTTP/3 enabled. The TLS certificate is issued by Let’s Encrypt (E8), which is typical for legitimate WordPress sites but does not mitigate the malicious content.

Registration information shows the domain was created on 3 March 2000 and is registered through MarkMonitor, Inc., a registrar commonly used for high‑value brand assets, suggesting the attacker leveraged a long‑standing domain to increase perceived legitimacy. The site is currently offline, returning an HTTP 410 Gone status, and has been removed from public access. However, the domain appears on at least one security blocklist, PhishDestroy, indicating that some downstream defenses have already taken action. The presence of the WordPress nameservers (ns1‑ns4.wordpress.com) confirms that the domain is hosted on the public WordPress.com platform, which can be abused by compromised accounts or malicious sub‑users.

Uncertainty remains regarding the original method of compromise—whether the attacker obtained legitimate publishing credentials or exploited a vulnerability in the WordPress service. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any re‑registration attempts.