help-metamaskio-docs[.]tem3[.]io

PhishDestroy identifies an active brand impersonation campaign targeting MetaMask users via the domain help-metamaskio-docs.tem3.io. This domain mimics official MetaMask documentation to deceive victims into exposing sensitive credentials or engaging with malicious crypto-related content. The threat actor leverages social engineering tactics, posing as trusted support resources to facilitate crypto drainer operations or credential theft. Users who interact with this domain risk financial loss, account compromise, or malware installation.

This domain was flagged by 18 out of 95 security vendors on VirusTotal, indicating widespread detection but not universal protection. Registered through GoDaddy.com, LLC on August 02, 2024, the domain resolves to IP address 188.114.96.3 and holds an SSL certificate issued by Google Trust Services. Google Safe Browsing has classified it under SOCIAL_ENGINEERING, and it appears on 1 security blocklist. Notably, MetaMask has proactively blocked this domain to safeguard its user base.

If you or your organization visited help-metamaskio-docs.tem3.io, immediately cease interaction and disconnect from the network. Do not enter any credentials, download files, or click on links. Scan all devices using updated antivirus software to detect potential infections. Report the domain to your IT security team or the targeted brand’s abuse channels. Exercise heightened caution with unsolicited communications referencing MetaMask or cryptocurrency transactions, and verify all URLs against official sources before engaging.