welcome-metamask-en[.]tem3[.]io

The domain welcome-metamask-en.tem3.io is identified as a high-risk brand impersonation threat specifically targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the site mimics MetaMask’s login interface, presenting a page titled 'Log-In | MetaMask®' to deceive users into entering credentials or private keys. The domain is currently offline, but prior activity suggests it operated as a fake login portal designed to harvest sensitive authentication details or facilitate cryptocurrency theft. Infrastructure analysis reveals the domain was registered on August 02, 2024, through GoDaddy.com, LLC. It resolves to the IP address 188.114.97.3, hosted behind CloudFlare, Inc. infrastructure in Canada. Security vendors flagged the domain as malicious, with 19 out of 95 VirusTotal engines detecting it as phishing or fraudulent. The domain appears on one security blocklist, and Google Safe Browsing explicitly labels it as a phishing site. The SSL certificate is issued by Google Trust Services under the WE1 root, a common certificate authority used by both legitimate and malicious sites, which does not mitigate the threat. The domain’s current offline status does not eliminate the risk, as similar infrastructure may be reactivated under different names. Users who accessed the site should assume credential exposure and immediately revoke active sessions, reset passwords, and enable multi-factor authentication on their MetaMask and associated accounts. Organizations should block the domain and its resolving IP at the network level. Security teams are advised to monitor for related domains using the 'tem3.io' second-level domain or similar naming patterns, as these may indicate ongoing or future campaigns targeting cryptocurrency users.