metamskapplogin[.]wordpress[.]com

Analysis of metamskapplogin.wordpress.com indicates a brand‑impersonation campaign targeting MetaMask users. The site returned HTTP status 410, confirming that the resource was removed, yet the domain remained resolvable to IP 192.0.78.13, an address owned by AS2635 Automattic, Inc. The server presented a valid Let's Encrypt certificate (E8) and employed WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, consistent with the standard WordPress.com hosting stack. The page title, "ḾétáMásk Lógin | Create Account | Sign In," incorporates accented characters and phrasing that closely mirrors legitimate MetaMask login prompts, supporting the attribution of a crypto‑scam impersonation.

The subdomain is hosted under the wordpress.com namespace and uses the default WordPress.com nameservers (ns1‑ns4.wordpress.com). Registration details show the domain was created on March 03, 2000 and listed under MarkMonitor, Inc., a registrar commonly used for brand‑protected domains, suggesting potential abuse of an existing legitimate subdomain. The domain appears on one security blocklist and was flagged by 12 of 95 vendors on VirusTotal, reinforcing its malicious reputation.

PhishDestroy has taken the domain offline, and current status is recorded as taken offline. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any re‑registration or resurrection of the subdomain, and educate users about unexpected MetaMask login requests that reference WordPress.com URLs. Threat intel feeds should be updated to include this indicator, and any email or messaging artifacts containing the domain should be quarantined or investigated.