metamaskwalleto[.]wordpress[.]com

On July 25, 2026, the domain metamaskwalleto.wordpress.com was observed as offline, returning HTTP 410. The site was hosted on WordPress.com infrastructure (ns1‑ns4.wordpress.com) and resolved to IP 192.0.78.13, which belongs to AS2635 Automattic, Inc, located in the United States. The TLS certificate was issued by Let’s Encrypt (certificate identifier E8), indicating a valid HTTPS endpoint at the time of capture. Service fingerprinting identified WordPress, MySQL, PHP, Nginx, HTTP/3 and HSTS, all typical of a standard WordPress.com blog.

The domain creation date is recorded as March 03 2000, and the registrar is listed as MarkMonitor, Inc. The page title returned by the server is “Site Title”, which provides no additional context. The domain is classified as a crypto‑related scam that impersonates the MetaMask brand. Two of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single security blocklist. The phishing‑specific blocklist PhishDestroy also lists the domain as blocked.

Evidence confirms that the infrastructure is controlled by a legitimate WordPress.com host, but the combination of brand impersonation, malicious classification, and detection by security vendors indicates a risk to users seeking MetaMask services. Uncertainty remains regarding the exact content that was served before the site was taken offline, as no page capture is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or re‑activation, and update any allow‑list policies that might inadvertently permit traffic to WordPress.com subdomains matching this pattern. Ongoing surveillance of the IP address and associated AS is recommended to capture any future malicious activity originating from the same hosting environment.