secure-metamask-help[.]square[.]site

This domain is flagged as a high-risk brand_impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the domain was designed to deceive users into believing it is an official support or verification portal for MetaMask, potentially facilitating credential theft or unauthorized transactions. Infrastructure analysis reveals the domain secure-metamask-help.square.site was registered on February 05, 2019, through MarkMonitor, Inc. It resolves to the IP address 74.115.51.5, hosted under AS27647 (Weebly, Inc.) in the United States. Security vendors on VirusTotal flagged the domain in 16 out of 95 scans, and it appears on three security blocklists, including PhishDestroy, MetaMask’s internal blocklist, and SEAL. The domain currently displays a 404 error page, though its SSL certificate, issued by Let’s Encrypt (serial number E7), remains active. Despite its offline status, historical data suggests persistent malicious intent. To mitigate risks associated with this brand_impersonation threat, organizations and users should block the domain and its associated IP (74.115.51.5) at the network level. Cryptocurrency service providers are advised to monitor for unauthorized access attempts linked to this domain and educate users on verifying official support channels. Security teams should review logs for prior interactions with this domain and investigate any residual SSL certificates tied to it. Proactive measures include updating blocklists and alerting users to the risks of engaging with unofficial support portals.