mettamasksigniin[.]wordpress[.]com

The domain mettamasksigniin.wordpress.com was observed as an offline site that previously presented the page title "MetaMask – The Crypto Wallet," indicating a brand impersonation of the MetaMask cryptocurrency wallet. Registration data shows the domain was created on March 03, 2000 and was registered through MarkMonitor, Inc., a registrar commonly used for legitimate brand domains, suggesting that the attacker leveraged a long‑standing domain to lend credibility. DNS resolution points to IP address 192.0.78.12, which belongs to AS2635 Automattic, Inc. and is located in the United States; the hosting environment runs WordPress on Nginx with MySQL and PHP, and employs HSTS and HTTP/3.

The site served an HTTP 410 status code before being taken offline, and the SSL certificate was issued by Let’s Encrypt (E8). Infrastructure analysis reveals four WordPress nameservers (ns1‑ns4.wordpress.com) consistent with the hosting provider. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy.

VirusTotal scans recorded nine detections out of ninety‑five security vendors, reinforcing the classification as a crypto‑related scam. While the exact page content was not captured, the combination of brand‑targeted page title, crypto‑scam designation, and observed detections provides sufficient evidence for security teams to add the domain to block lists, monitor for any reappearance, and advise users to avoid any links referencing this host. Defenders should also consider reviewing related WordPress subdomains for similar impersonation tactics.