blog-metamask-io-en[.]tem3[.]io

This domain, blog-metamask-io-en.tem3.io, is identified as a high-risk credential harvesting operation targeting MetaMask users. Analysis confirms brand impersonation tactics, presenting a fraudulent login interface titled 'Login | MetaMask Developer' to deceive victims into disclosing wallet credentials. The infrastructure appears designed to facilitate cryptocurrency theft through social engineering, though no specific drainer kit signatures were observed in initial triage. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted behind CloudFlare infrastructure in Canada. Registered through GoDaddy.com, LLC on August 02, 2024, the domain has been flagged by 19 out of 95 security vendors on VirusTotal. Google Safe Browsing categorizes this domain as phishing, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services under the WE1 root, providing a false sense of legitimacy to potential victims. As of the latest verification, blog-metamask-io-en.tem3.io has been taken offline, though residual risk persists. The domain's removal from active DNS records follows detection by multiple threat intelligence platforms, including PhishDestroy. However, the short lifespan (less than one month from registration to takedown) suggests potential for rapid redeployment under similar naming conventions. Users are advised to verify domain authenticity through official channels before entering credentials, particularly for cryptocurrency-related services. Organizations should monitor for related domains using the 'tem3.io' subdomain pattern or similar MetaMask impersonation schemes.