docs-lgnmetamask[.]square[.]site

Domain docs-lgnmetamask.square.site was registered on 11 May 2026 through MarkMonitor Inc. The domain resolves to IP 74.115.51.4, which is geolocated to the United States and associated with Weebly, Inc. The site presents a valid TLS certificate issued by Let’s Encrypt (E8) and returns HTTP 200 for requests. Nameservers are hosted on AWS (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, …). VirusTotal analysis shows that 8 of 95 scanned security vendors flag the domain as malicious. Independent blocklists confirm the domain is listed on three external blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The page title retrieved from the site, “Log--- Metamask | kash”, together with the declared scam type “phishing_login”, indicates an attempt to harvest credentials for the MetaMask brand. The infrastructure aligns with typical credential‑phishing campaigns: a short‑lived domain, a public‑cloud hosting provider, and a TLS certificate that may lend superficial legitimacy. Defenders should continue to block the domain at network perimeter and DNS layers, and consider adding the IP address to threat‑intel feeds. Monitoring of the associated AWS nameservers for further sub‑domains is advisable, as the current infrastructure could be reused for additional phishing sites. End‑users should be warned that any login prompt originating from this domain is not authorized by the MetaMask service, and credentials entered there are likely to be exfiltrated.