support-en-metamaskhelp[.]tem3[.]io

This domain, support-en-metamaskhelp.tem3.io, is identified as a brand impersonation threat targeting MetaMask users through credential phishing. The site mimics the official MetaMask login interface, presenting a high-risk vector for unauthorized account access and financial theft. Analysis confirms the domain is currently offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals critical technical indicators: the domain was registered through GoDaddy.com, LLC on August 2, 2024, and resolved to the IP address 188.114.97.3, hosted under CloudFlare infrastructure in Canada. Security vendors flagged the domain in 20 of 95 VirusTotal assessments, with one active blocklist entry. The SSL certificate, issued by Google Trust Services (WE1), aligns with legitimate encryption practices but does not mitigate the underlying phishing intent. The page title, 'Sign In | Metamask.com® - Log-in,' directly replicates MetaMask’s branding to deceive users. Current status indicates the domain has been taken offline, reducing immediate risk. However, historical exposure and residual threat potential necessitate proactive measures. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on all cryptocurrency wallets, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while security teams should investigate related infrastructure for additional impersonation attempts. Continuous vigilance is recommended due to the elevated risk profile of credential phishing in the cryptocurrency sector.