web-metama-sklogin-secure[.]tem3[.]io

This advisory addresses a high-risk brand impersonation attack targeting MetaMask users via the domain web-metama-sklogin-secure.tem3.io. The site was crafted to mimic the legitimate MetaMask login interface, aiming to steal credentials and potentially drain crypto wallets. Its page title, "MetaMask Login* Guide | Manage Your Crypto with Ease," further tricks users into believing it is an official support page.

A deep dive into the indicators reveals concerning details. The domain was created on August 2, 2024, and resolves to IP 188.114.97.3. VirusTotal flagged it with 18 out of 95 security vendors marking it as malicious, and it appears on three security blocklists. Google Safe Browsing specifically flags it for phishing. It was registered through GoDaddy.com, LLC and had an SSL certificate issued by Google Trust Services. The current status shows the domain has been taken offline, but users may still have encountered it previously.

To protect against this type of brand impersonation, users should always verify the URL before entering any credentials or sensitive information. Never click on links from unsolicited emails or messages claiming to be from MetaMask. Enable two-factor authentication on your crypto accounts and consider using a hardware wallet for added security. If you have already used this domain, change your MetaMask password immediately and move your assets to a new wallet.