public-metamask-login[.]square[.]site

The domain public-metamask-login.square.site is currently active and engaged in brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. This site operates as a credential harvesting platform, designed to deceive users into submitting sensitive authentication details under the pretense of legitimate MetaMask verification procedures. Analysis confirms the domain remains operational, presenting an elevated risk to users unfamiliar with cryptocurrency security practices. Infrastructure analysis reveals the domain was registered on February 05, 2019, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. It resolves to the IP address 74.115.51.4, geolocated within the United States under autonomous system AS27647 (Weebly, Inc.). The SSL certificate is issued by Let's Encrypt (serial number E7), providing encrypted connections that may lend an appearance of legitimacy. Detection metrics indicate the domain is flagged by 15 of 95 security vendors on VirusTotal, while appearing on one additional security blocklist. The page title, 'Nur einen Moment…,' suggests the use of evasion techniques to delay or obscure malicious content delivery. Current assessment classifies this domain as an active threat with elevated risk due to its prolonged operational history, targeted brand impersonation, and limited but persistent detection footprint. Users are advised to verify domain authenticity before entering credentials, particularly when prompted by unsolicited links. Network administrators should consider blocking the IP address 74.115.51.4 and implementing real-time monitoring for connections to the domain. Cryptocurrency wallet users are recommended to enable multi-factor authentication and access services exclusively through official channels to mitigate credential exposure risks.