metamaaklogin[.]wordpress[.]com

Analysis of the domain metamaaklogin.wordpress.com indicates a wallet-seed phishing campaign impersonating MetaMask. The domain, hosted on Automattic infrastructure (AS2635, IP 192.0.78.13), was flagged by one security blocklist (PhishDestroy) and detected by 2 of 95 security vendors on VirusTotal. The page title, 'ḾétáMásk – Lógin', uses Unicode homoglyphs to mimic the legitimate MetaMask brand, a technique commonly employed to deceive users into entering sensitive wallet credentials. The domain was registered through MarkMonitor, Inc. on March 3, 2000, though this date may reflect an administrative placeholder rather than active malicious use.

Nameservers (ns1.wordpress.com, ns2.wordpress.com, ns3.wordpress.com, ns4.wordpress.com) and detected technologies (WordPress, MySQL, PHP, Nginx, HSTS, HTTP/3) align with typical WordPress hosting environments, which are frequently abused for phishing due to their accessibility and perceived legitimacy. The HTTP status code 410 (Gone) suggests the domain has been taken offline, though historical activity remains a concern for retrospective threat hunting. The SSL certificate, issued by Let's Encrypt (serial E8), provides no inherent trust signal beyond basic encryption. No additional indicators, such as Safe Browsing classifications or Open Threat Exchange (OTX) submissions, were present in the available intelligence.

Defenders should treat this domain as a confirmed phishing artifact, particularly in environments where MetaMask or cryptocurrency-related activity is relevant. Blocklist integration and retrospective log searches for connections to 192.0.78.13 or the domain itself are recommended to identify potential prior compromise. The absence of further detection or brand-specific artifacts does not reduce the risk; wallet-seed phishing campaigns often rely on short-lived domains and minimal infrastructure to evade detection.