airdrop[.]testnet[.]treasurenet[.]io

The domain airdrop.testnet.treasurenet.io is a phishing site that impersonates the brand Metamask. It poses a significant threat through brand impersonation and is associated with an airdrop scam and a wallet connect phishing attempt. The site is currently taken offline, reducing the immediate risk to users, but caution is advised as the threat may re-emerge.

airdrop.testnet.treasurenet.io was created on January 18, 2022, and is registered through Cloudflare, Inc. The domain resolves to the IPv6 address 2606:4700:20::ac43:4adb, which is located in the United States under the AS13335 Cloudflare, Inc. network. The SSL certificate is issued by Google Trust Services / WE1. Despite its current offline status, the domain has been flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Webroot, and appears on 1 security blocklist, specifically PhishDestroy.

If a user has interacted with airdrop.testnet.treasurenet.io, they should immediately change their Metamask wallet passwords and enable two-factor authentication (2FA) to enhance security. Users should also revoke any unauthorized token approvals and consider moving funds to a new wallet to prevent potential fraud. To help mitigate the spread of this phishing activity, users can report the domain to their security vendor, PhishTank, and Google Safe Browsing. Additionally, staying informed about common phishing tactics and verifying the legitimacy of URLs before interacting with them can further protect against such scams.