metamasktzlogin[.]wordpress[.]com

metamasktzlogin.wordpress.com was observed serving a page titled “ḾétâMaśk Login | login in to account”. The page title directly references the MetaMask brand, indicating an attempt to deceive users seeking cryptocurrency wallet access. The site resolved to IP 192.0.78.12, which belongs to AS2635 Automattic, Inc., a hosting provider for WordPress.com services. The hosting environment disclosed WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, consistent with the platform’s standard stack. The domain is registered through MarkMonitor, Inc., a registrar commonly used for legitimate brand protection, but the registration date of March 03 2000 predates the emergence of MetaMask, suggesting the domain was repurposed for malicious use.

An SSL certificate issued by Let’s Encrypt (certificate identifier “E8”) was active at the time of observation, providing encrypted transport but not authentication of the site’s legitimacy. VirusTotal analysis recorded eight detections out of ninety‑five scanners, confirming that multiple security vendors flagged the domain as malicious. The site appears on a single external blocklist and is listed as blocked by PhishDestroy, reinforcing its classification as a crypto‑related scam. HTTP response code 410 indicates the resource was removed, and the current status is reported as offline, which may be a temporary takedown or an attempt to evade detection.

Defenders should continue to block the domain at network perimeter and update URL filtering rules. Threat intelligence consumers should note the association with the MetaMask brand and the use of a legitimate WordPress hosting provider, which may be leveraged in future campaigns. Monitoring of the IP address 192.0.78.12 for related activity and periodic re‑scanning of the domain, should it reappear, is recommended. Attribution remains uncertain beyond the observed infrastructure; no malware kit or additional payload information is available.