v3[.]generatehelpticket[.]info

Analysis of the domain v3.generatehelpticket.info confirms active phishing infrastructure targeting MetaMask users. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to the IP address 45.87.81.229, hosted on AS47583 under Hostinger International Limited in the Netherlands. The page title, 'Crypto Wallet Issues? We've Got You Covered!', directly aligns with known brand impersonation tactics, specifically airdrop scams and wallet connection phishing schemes. Infrastructure review reveals that the domain is configured with nameservers dns1.registrar-servers.com and dns2.registrar-servers.com, consistent with registrar-managed DNS setups. At the time of assessment, the site returns an HTTP 403 status, though this does not indicate takedown; rather, it may reflect access restrictions or backend changes to evade detection. The absence of an SSL certificate further reduces the perceived legitimacy of the site, a common characteristic in short-lived phishing domains. Detection metrics indicate limited but targeted awareness: one security vendor on VirusTotal flags the domain as malicious, and it appears on a single security blocklist. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high-risk classification. While the low detection count may suggest either recent deployment or evasion techniques, the domain's creation date and persistent resolution to an active IP confirm ongoing operational status. Defenders should prioritize blocking 45.87.81.229 and monitoring related subdomains under generatehelpticket.info. Given the domain's registration age and clear association with MetaMask impersonation, organizations should treat any user interaction with this infrastructure as a potential compromise of wallet credentials or seed phrases. Automated takedown requests to the registrar and hosting provider are recommended to disrupt this campaign.