metaamaxlogin[.]wordpress[.]com

Analysis of the domain metaamaxlogin.wordpress.com indicates it was actively used for credential phishing targeting users of the MetaMask cryptocurrency wallet. The domain, hosted on WordPress infrastructure (AS2635 Automattic, Inc), resolved to the IP address 192.0.78.12, located in the United States. The page title, 'Ṁéťáḿ𝚊ṥǩ 𝙻ǒǧǐṅ – 𝙶𝚎𝚝𝚝𝚒𝚗𝚐 𝚂𝚝𝚊𝚛𝚝𝚎𝚍 𝚠𝚒𝚝𝚑 𝙼𝚎𝚝𝚊𝚖𝚊𝚜𝚔 𝚘𝚗𝙲𝚑𝚖𝚎,' explicitly references MetaMask, confirming the intended brand deception. The domain was registered through MarkMonitor, Inc., with nameservers ns1.wordpress.com, ns2.wordpress.com, ns3.wordpress.com, and ns4.wordpress.com, and employed a Let's Encrypt SSL certificate (serial E8).

Technologies detected on the infrastructure include WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, consistent with legitimate WordPress hosting but repurposed for malicious activity. As of the report date, the domain has been taken offline, returning an HTTP 410 status code, which indicates intentional removal. Prior to takedown, the domain was flagged by 8 of 95 security vendors on VirusTotal and appeared on at least one security blocklist, including PhishDestroy. The domain's creation date is listed as March 3, 2000, though this may reflect a re-registration or administrative artifact rather than the actual malicious deployment timeline.

Defenders should treat this domain as confirmed phishing infrastructure targeting MetaMask credentials. The use of WordPress hosting and a valid SSL certificate demonstrates an attempt to blend with legitimate traffic, a common tactic in credential harvesting campaigns. While the domain is currently offline, historical resolutions and associated IP addresses should be monitored for reactivation or migration to new domains. No evidence of additional scam types or secondary payloads was identified in the available data.