connect-metamask-login[.]square[.]site

This domain is classified as a high-risk phishing endpoint specifically targeting cryptocurrency wallet users through brand impersonation of MetaMask. Analysis indicates the infrastructure was designed for credential harvesting, with technical indicators confirming malicious intent against digital asset holders. Infrastructure analysis reveals multiple concrete threat indicators: the domain is flagged by 20 out of 95 security vendors on VirusTotal, blocked by three security blocklists including PhishDestroy and MetaMask's internal systems, and marked as phishing by Google Safe Browsing. The domain was registered through MarkMonitor, Inc. on February 21, 2026, resolving to IP address 74.115.51.5 hosted on AS27647 (Weebly, Inc.) in the United States. A Let's Encrypt SSL certificate (serial E7) was deployed, while the page title returned a 404 error, suggesting either takedown or operational concealment. The creation date discrepancy (2026) further indicates suspicious registration practices. Mitigation requires immediate action from both users and infrastructure providers. Users should revoke any connected wallet authorizations, rotate credentials for all cryptocurrency accounts, and verify transaction histories for unauthorized activity. Infrastructure providers should implement DNS-level blocking of the domain and IP address, while monitoring for related subdomains on the square.site namespace. Security teams should correlate the SSL certificate serial (E7) and hosting provider (AS27647) with other known phishing campaigns targeting cryptocurrency services. The domain's current offline status does not eliminate risk, as threat actors frequently reactivate infrastructure for subsequent attacks.