metanmasklogin[.]wordpress[.]com

This domain, metanmasklogin.wordpress.com, poses a direct threat to users by impersonating the official MetaMask cryptocurrency wallet login page. The site is designed to deceive visitors into entering sensitive credentials, such as wallet recovery phrases or private keys, which attackers can then exploit to gain unauthorized access to digital assets. The page title, 'Metamask | Login – Metamask Login,' closely mimics legitimate MetaMask branding, increasing the likelihood of successful phishing attempts. Analysis indicates this is not a random or opportunistic attack but a deliberate attempt to exploit trust in a widely used cryptocurrency platform.

Infrastructure analysis reveals several technical indicators confirming the malicious nature of this domain. The domain was registered on March 03, 2000, through MarkMonitor, Inc., though the impersonation content appears to have been deployed recently. It resolves to the IP address 192.0.78.12, hosted on Automattic, Inc. infrastructure (AS2635). The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. VirusTotal reports that 10 out of 95 security vendors have flagged this domain as malicious, with one confirmed blocklist entry (PhishDestroy). The combination of brand impersonation, recent malicious activity, and low detection rates among vendors suggests a targeted or low-volume campaign designed to evade broader scrutiny.

Users who visited metanmasklogin.wordpress.com and entered any credentials or sensitive information should take immediate action to mitigate potential risks. First, disconnect any active sessions with the legitimate MetaMask service and revoke access to any connected applications or browser extensions. Reset all passwords and recovery phrases associated with MetaMask or other cryptocurrency wallets, ensuring new credentials are unique and complex. Monitor wallet transactions for unauthorized activity and consider transferring assets to a new wallet if compromise is suspected. Report the incident to the legitimate platform and relevant cybersecurity authorities to aid in tracking and takedown efforts. Future vigilance is critical, as attackers may reuse stolen credentials or target victims with follow-up phishing attempts.