access-m-etamask-log[.]tem3[.]io

This domain, access-m-etamask-log.tem3.io, operates as a credential harvesting site targeting users of the MetaMask cryptocurrency wallet. The infrastructure presents a fraudulent login interface mimicking MetaMask’s official authentication portal, specifically designed to capture sensitive user credentials, including wallet seed phrases and private keys. The page title, 'Log In MetaMask Secure for DeFi, NFTs & dApps,' reinforces the deception by replicating MetaMask’s branding and value proposition, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Analysis indicates the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Security vendor detections on VirusTotal report 20 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), further legitimizes the site’s appearance, despite its fraudulent purpose. Google Safe Browsing has also classified the domain as phishing infrastructure. Users who have interacted with this domain should immediately revoke any entered credentials and assume their MetaMask wallet or associated accounts are compromised. It is recommended to transfer remaining funds to a new, secure wallet using a clean device and monitor all linked accounts for unauthorized transactions. Additionally, affected users should review connected decentralized applications (dApps) for suspicious permissions and revoke access where necessary. Organizations and security teams are advised to block the domain and associated IP address at the network level to prevent further exposure.