metamaskwaliet[.]wordpress[.]com

Analysis of metamaskwaliet.wordpress.com indicates that the site was deliberately crafted to impersonate the MetaMask brand. The page title, "M̾etaM̾ask Wallet – Buy Crypto In Minutes," directly references the targeted brand and aligns with the reported crypto‑scam classification. Technical fingerprinting shows the site operated on a standard WordPress stack with MySQL, PHP, and Nginx, and it served content over HTTPS using a Let’s Encrypt certificate (type E8). The domain resolved to IP address 192.0.78.13, which belongs to AS2635 (Automattic, Inc.) and is geolocated in the United States.

DNS resolution employed the four default WordPress nameservers (ns1‑ns4.wordpress.com). Registration details list MarkMonitor, Inc. as the registrar, and the domain creation date is recorded as March 03, 2000, suggesting the subdomain was established long after the parent domain’s inception. The site is currently offline, returning HTTP status 410, and has been removed from public access. Security‑vendor scans on VirusTotal reported ten detections out of ninety‑five scanners, and the domain appears on a single blocklist, specifically PhishDestroy, which has already taken action to block it.

While the site’s content is no longer reachable, the observable infrastructure—particularly the use of a legitimate WordPress hosting environment and a valid SSL certificate—demonstrates a common tactic of leveraging trusted services to increase perceived legitimacy. Defenders should continue to block the associated IP address and the specific subdomain, monitor for any re‑registration attempts, and update detection rules to flag the exact page title pattern. Additional vigilance is advised for any future domains that employ similar brand‑targeted titles or that resolve to the same Automattic IP range, as these may indicate a broader campaign using compromised or abused WordPress hosting.