metamask-log-web[.]square[.]site

This domain, metamask-log-web.square.site, poses a high-risk phishing threat designed to impersonate the official MetaMask cryptocurrency wallet interface. Attackers use this site to trick users into entering sensitive credentials, such as seed phrases or private keys, under the false pretense of account verification or wallet recovery. Once submitted, these details are harvested and used to drain digital assets from victims' wallets, often resulting in irreversible financial loss. The site mimics legitimate MetaMask branding, including logos and login prompts, to appear credible to unsuspecting users. Analysis indicates this domain was registered through MarkMonitor, Inc. on February 21, 2026, though its creation date suggests potential backdating or administrative anomalies. It resolves to the IP address 74.115.51.5, hosted on infrastructure belonging to Weebly, Inc. (AS27647). The domain is flagged by 21 out of 95 security vendors on VirusTotal, with additional detections from Google Safe Browsing and three other security blocklists. Its SSL certificate, issued by Let’s Encrypt, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. If you visited metamask-log-web.square.site or entered any credentials, take immediate action to secure your assets. First, disconnect any active sessions linked to the site and revoke permissions for connected applications via your MetaMask settings. Next, transfer remaining funds to a new, secure wallet using a fresh seed phrase generated offline. Monitor your accounts for unauthorized transactions and enable two-factor authentication where possible. Report the incident to MetaMask’s official support channels and consider filing a complaint with relevant cybercrime authorities to aid in tracking the infrastructure.