metamaskdrlogin[.]wordpress[.]com

On July 24, 2026, analysis of the domain metamaskdrlogin.wordpress.com confirms that it was used to host a MetaMask‑related crypto scam. The site was registered on March 03 2000 and is hosted on the WordPress.com platform, as indicated by the nameservers ns1‑ns4.wordpress.com and the presence of WordPress, MySQL, PHP, Nginx, HSTS and HTTP/3 in the technology fingerprint. The HTTP response code returned 410, indicating that the content has been removed, and the domain is currently listed as offline. The page title observed during the brief crawl – “MetáMask Login | Log In to Account” – aligns with the declared brand impersonation of MetaMask.

Network telemetry shows the domain resolving to 192.0.78.13, an address owned by AS2635 Automattic, Inc. in the United States. The SSL certificate is issued by Let’s Encrypt (E8), which is typical for WordPress.com sites and does not provide authentication of the underlying entity. Reputation checks reveal that ten of ninety‑five VirusTotal scanners flagged the domain as malicious, and the site is present on one external blocklist, specifically PhishDestroy, which has actively taken the domain offline. Registration data lists MarkMonitor, Inc. as the registrar, a service often used for legitimate brand protection, suggesting that the registration record may have been hijacked or spoofed.

No additional public intelligence such as OTX or Safe Browsing is available beyond the blocklist entry. Given the confirmed impersonation of MetaMask and the presence of a crypto‑related scam indicator, defenders should continue to block the domain at perimeter defenses, update URL filtering rules, and monitor for any resurgence of the host under new subdomains. Incident response teams should also notify affected users that any credentials entered on the site are compromised, and advise them to rotate MetaMask credentials and review associated blockchain accounts for unauthorized activity.