en-metamask-logi[.]square[.]site

Analysis of en-metamask-logi.square.site identifies a high-risk brand impersonation domain targeting MetaMask users, classified as a crypto scam. The domain, registered through MarkMonitor, Inc. on February 5, 2019, resolves to IP 74.115.51.5 (AS27647 Weebly, Inc., US) and was hosted on Amazon Web Services with Cloudflare technologies. At the time of assessment, the domain returned an HTTP 404 status, though historical records show a page title of 'Um momento…' and Google Safe Browsing flagged it for social engineering. The domain appears on one security blocklist (PhishDestroy) and was flagged by 12 of 95 security vendors on VirusTotal.

Nameservers include ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns. SSL certification was issued by Let's Encrypt (serial E7). Defenders should treat this domain as malicious, particularly in environments where MetaMask or cryptocurrency-related activity occurs.

The domain is currently offline, but historical infrastructure and detection data indicate persistent risk. No evidence confirms the exact scam mechanics or payload delivery, but the combination of brand impersonation, social engineering flags, and crypto scam classification warrants blocking at the DNS and proxy levels. Further investigation should include reviewing logs for connections to 74.115.51.5 or related AWS/Cloudflare infrastructure, particularly from endpoints with cryptocurrency wallet software.