meta-mas-klogin-get[.]tem3[.]io

PhishDestroy identifies active brand impersonation targeting MetaMask users via the domain meta-mas-klogin-get.tem3.io. This domain is part of a credential theft campaign designed to harvest login details and cryptocurrency wallet information under the guise of a MetaMask login portal. The infrastructure leverages a classic phishing template, likely a drainer kit, to mimic MetaMask’s authentication flow and deceive victims into entering sensitive credentials. This domain was flagged by 14 out of 95 VirusTotal security vendors and is registered through GoDaddy.com, LLC. It resolves to IP address 188.114.97.3 and was created on August 02, 2024. Google Safe Browsing classifies this domain under SOCIAL_ENGINEERING, and it appears on one security blocklist. The presence of a Google Trust Services SSL certificate adds superficial legitimacy, potentially increasing successful deception rates among non-technical users. The campaign remains active as of security monitoring on seed d72cd8. MetaMask has already blocked this domain, and proactive takedown efforts are recommended. Despite these actions, the domain continues to pose a high risk due to its recent creation, active hosting, and partial evasion of detection. Users are strongly advised to avoid interacting with any unsolicited links claiming to be MetaMask login pages and to verify domains through official MetaMask channels before entering credentials.