metamassk-log-inn[.]square[.]site

metamassk-log-inn.square.site is a newly registered (12 March 2026) domain that mimics the MetaMask brand. The site returns HTTP 200 and displays the generic title “Just a moment…”, a pattern commonly used to delay analysis while loading malicious content. The domain is classified as a high‑risk brand‑impersonation vector and remains active as of 12 July 2026. Infrastructure analysis shows the domain resolves to 74.115.51.5, an address located in the United States and owned by AS27647 (Weebly, Inc.). The authoritative name servers are ns‑810.awsdns‑37.net, ns‑1816.awsdns‑35.co.uk, ns‑311.awsdns‑38.com, and additional AWS DNS entries, indicating the use of Amazon Route 53 for DNS resolution. The web stack includes Weebly, MySQL, PHP, Vue.js, reCAPTCHA, and Cloudflare, suggesting a hosted website that leverages common web‑application components to appear legitimate. Threat‑intelligence feeds have flagged the domain on three blocklists, and security vendors on VirusTotal have raised alerts on 9 of 95 scanners. The site is currently blocked by PhishDestroy, MetaMask, and SEAL, and it received a Gridinsoft trust score of 0 / 100. Registration was performed through MarkMonitor, Inc., a registrar often associated with legitimate brand protection services, which may be used to lend credence to the impersonation. Defenders should add the domain and its resolved IP to outbound and inbound deny lists, monitor DNS queries for the listed AWS name servers, and enforce strict credential‑entry controls for any MetaMask‑related workflow. Incident response teams are advised to capture network traffic to the IP address for forensic analysis, and to alert end users about the specific domain name to prevent credential harvesting. Continuous re‑evaluation of the blocklist status is recommended, as the infrastructure could be repurposed for additional campaigns.