metumasklvgen[.]wordpress[.]com

Analysis conducted on July 29, 2026 identifies metumasklvgen.wordpress.com as an active generic phishing infrastructure with an elevated risk rating. The domain resolves to the IP address 192.0.78.13 and is hosted on the WordPress.com platform, as indicated by its four WordPress nameservers (ns1.wordpress.com through ns4.wordpress.com). Registration data shows the domain was created on March 03, 2000 and is listed with MarkMonitor, Inc. as the registrar, a provider commonly associated with high‑value brand protection. VirusTotal scans report that three of ninety‑one security vendors have flagged the domain, confirming its presence on malicious reputation services.

Independent blocklists corroborate this assessment: the domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. The inclusion of MetaMask in the blocklist suggests the campaign is attempting to impersonate the MetaMask cryptocurrency wallet, although the public page content has not been captured for verification. No additional evidence such as SSL certificate details, HTTP response codes, or page‑title metadata is available at this time, leaving those aspects of the infrastructure unverified. Defenders should prioritize the immediate addition of metumasklvgen.wordpress.com to network‑level deny lists and endpoint protection policies, given its confirmed detection across multiple vendors and its alignment with known brand‑targeted phishing operations.

Continuous monitoring of traffic to the associated IP address (192.0.78.13) and the WordPress hosting environment is recommended to detect any future shifts in activity. Organizations that rely on MetaMask or related cryptocurrency services should alert users to the presence of this malicious domain and reinforce credential‑handling procedures.