metamaskextensions[.]wordpress[.]com

metamaskextensions.wordpress.com is an inactive site that was used to masquerade as the MetaMask cryptocurrency wallet. The domain was created on 2000-03-03 and is hosted on the WordPress.com platform under the IP address 192.0.78.12, which belongs to AS2635 Automattic, Inc. The authoritative nameservers are ns1-wordpress.com, ns2-wordpress.com, ns3-wordpress.com, and ns4-wordpress.com, and the site served a valid Let’s Encrypt certificate (issuer E8). HTTP requests return a 410 Gone status, indicating the content has been removed, and the site is currently listed as offline.

Security telemetry shows the domain appears on one public blocklist and is blocked by PhishDestroy. VirusTotal scans flagged the domain by four of ninety‑five vendors, providing additional confirmation of malicious intent. The page title retrieved from the site reads “MetaMask – A crypto wallet & gateway to blockchain apps”, which aligns with the declared brand target of MetaMask and the classified scam type of a crypto scam. Detected technologies include WordPress, MySQL, PHP, Nginx, HTTP/3 and HSTS, all typical of the WordPress.com hosting environment.

Analysis indicates that the domain leveraged the trusted WordPress.com infrastructure to lend credibility to the impersonation attempt. Because the site is no longer serving content, the immediate risk to end users is reduced, but the domain remains a potential vector for future re‑use or for cache‑based attacks. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the host name, and update threat intelligence feeds with the observed indicators. Further investigation of the four vendor detections on VirusTotal may reveal specific payloads or phishing templates that were previously hosted. At present, no additional evidence such as screenshots or login page captures is available, so the full scope of the impersonation campaign remains uncertain.