metmsk-ioex-tension[.]square[.]site

The domain metmsk-ioex-tension.square.site is currently listed as offline, returning an HTTP 404 response. DNS resolution points to IP address 74.115.51.4, which is allocated to the United States and associated with AS27647 Weebly, Inc. The hosting environment shows artifacts of Amazon Web Services and Cloudflare, and the authoritative name servers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns. The site uses a Let’s Encrypt certificate identified as version E7, indicating TLS termination was in place when the domain was active. Registration data reveals the domain was created on February 5, 2019 through MarkMonitor, Inc., a registrar commonly used for high‑value brands.

VirusTotal scans have recorded 12 detections out of 95 scanned engines, and the domain appears on a single security blocklist. PhishDestroy has explicitly blocked the domain, and the only visible page title observed is “Nur einen Moment…”, which does not provide further context about the payload. The combination of a relatively old registration date, use of reputable infrastructure providers, and a modest but non‑trivial detection rate suggests the domain was leveraged for a generic phishing campaign before being taken down. Because the site is already returning 404, immediate content‑based mitigation is limited; however, defenders should still enforce network‑level controls that block resolution to the identified IP address and the domain name itself.

Adding the domain to internal DNS blocklists, updating web‑proxy filtering rules, and monitoring for any resurgence of the same IP or similar name‑server patterns are recommended. Continuous re‑scanning on VirusTotal or equivalent platforms is advised to capture any new detections should the domain be re‑hosted.