mettamckdlogin[.]wordpress[.]com

On July 25, 2026, an analysis of mettamckdlogin.wordpress.com revealed that it is associated with a credential phishing threat. The domain has been flagged by 9 out of 95 security vendors on VirusTotal, and it is currently listed on one security blocklist. The site was taken offline, with an HTTP status of 410, indicating that the content is no longer available but may have been accessible in the past. The domain was registered through MarkMonitor, Inc., and resolves to the IP address 192.0.78.13, which is located in the United States and part of the AS2635 Automattic, Inc. network.

The SSL certificate is issued by Let's Encrypt, and the site uses HSTS and HTTP/3 for secure communication. The detected technologies include WordPress, MySQL, PHP, and Nginx. The page title, 'MetáMásk Lógín : Bítcóín & Cryptó Exchange,' suggests that the domain may have been used to phish credentials related to cryptocurrency exchanges. While the exact content and layout of the site have not been analyzed, the page title and the known scam type indicate a potential focus on stealing login credentials for cryptocurrency accounts.

Defenders are advised to ensure that their users are aware of the risks associated with this domain and to configure their systems to block access to it. Given that the domain is currently offline, monitoring for its reactivation is recommended. Additionally, the domain's creation date on March 03, 2000, suggests that the domain may have a history of legitimate use before being repurposed for malicious activities. Regular updates to threat intelligence feeds and security policies can help mitigate the risk of such domains being used in future phishing campaigns.