sso-webpage--metamask-com[.]tem3[.]io

This domain is flagged as a high-risk brand impersonation threat targeting MetaMask users. Analysis indicates the infrastructure was designed to deceive victims into entering cryptocurrency wallet credentials through a fraudulent login portal, a tactic commonly associated with crypto drainer operations. The page title, 'Log-In | Metamask®,' closely mimics the legitimate MetaMask authentication interface, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain sso-webpage--metamask-com.tem3.io was registered on August 02, 2024, through GoDaddy.com, LLC. It resolved to the IP address 188.114.97.3 and was hosted using technologies including Node.js, React, Next.js, and Cloudflare. Security vendors flagged the domain on VirusTotal with 19 out of 95 detections, while Google Safe Browsing classified it under 'SOCIAL_ENGINEERING.' The domain appears on one security blocklist and has been taken offline. Additional technical indicators include a Gridinsoft trust score of 0/100 and an SSL certificate issued by Google Trust Services. The use of Cloudflare and HTTP/3 suggests an attempt to evade detection and enhance performance for malicious purposes. Organizations and individuals should implement the following mitigation measures to counter this threat. First, block the domain and its associated IP address (188.114.97.3) at the network perimeter to prevent access. Second, deploy endpoint protection rules to detect and alert on any attempts to access the domain or similar impersonation attempts. Third, educate users on recognizing brand impersonation tactics, particularly in the context of cryptocurrency wallets, by emphasizing the importance of verifying domain authenticity and SSL certificates before entering credentials. Finally, monitor for newly registered domains containing 'MetaMask' or similar variations, as threat actors frequently rotate infrastructure to evade detection.