mtamskk-loginen[.]square[.]site

PhishDestroy identifies mtamskk-loginen.square.site as an active credential theft domain engaged in phishing operations targeting cryptocurrency wallet users. The domain mimics MetaMask login interfaces to harvest private keys and seed phrases, indicative of a credential harvesting campaign designed for crypto drainer deployment. Security research indicates this infrastructure is part of a broader ecosystem of impersonation sites leveraging spoofed branding to deceive victims into surrendering authentication credentials for wallet drainer operations. This domain was flagged by PhishDestroy with the following technical indicators: registered through MarkMonitor Inc., secured with a Let's Encrypt SSL certificate, and resolving to IP 74.115.51.4. The domain was created on February 05, 2019, and as of the latest analysis is marked with a VirusTotal detection score of 14/95, indicating it remains undetected by most antivirus engines. It has been identified on 2 security blocklists and is currently blocked by MetaMask and SEAL security systems. While this domain is under active investigation and currently flagged as 'under_investigation,' its live status and low detection profile pose a significant risk to users who may encounter it through phishing emails or spoofed websites. The threat level remains elevated due to the absence of widespread detection and the domain's history of prolonged operation, suggesting adversaries are leveraging established infrastructure for malicious purposes. Users are advised to immediately block access to mtamskk-loginen.square.site, update their security tooling to include domain-based indicators, and verify all wallet login URLs against official sources before entering credentials.