metamaskzlogin[.]wordpress[.]com

The domain metamaskzlogin.wordpress.com was observed to host a page titled “Metάmάsk Login – A crypto wallet & gateway to blockchain apps,” explicitly referencing the MetaMask brand. Registration data shows the domain was created on March 03, 2000 and is registered through MarkMonitor, Inc., a registrar commonly used for legitimate brand protection. DNS resolution points to the IP address 192.0.78.13, which belongs to AS2635 Automattic, Inc. in the United States, indicating the site was hosted on WordPress.com infrastructure. The name‑server set consists of ns1‑ns4.wordpress.com, confirming reliance on the standard WordPress hosting stack.

An SSL certificate issued by Let’s Encrypt (E8) was present, providing transport‑layer encryption but offering no assurance of legitimacy. HTTP probing returned a 410 Gone status, and the domain is currently marked as offline, suggesting the content has been removed or the site taken down. VirusTotal analysis recorded 13 detections out of 95 scanned vendors, and the domain is listed on a single security blocklist. It has also been blocked by the PhishDestroy service.

Technical fingerprints include WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, all typical of a WordPress‑hosted site. The evidence collectively points to a brand‑impersonation campaign targeting MetaMask users, likely intended to harvest credentials for cryptocurrency wallets. Uncertainty remains regarding the exact content that was served before takedown, as no live page snapshot is available. Defenders should continue to block the IP 192.0.78.13, add the domain to internal blocklists, monitor for re‑registration or similar sub‑domains, and educate users that legitimate MetaMask login pages are served from official MetaMask domains and never from wordpress.com subdomains.