m[.]metmask[.]top

The domain m.metmask.top has been identified as a brand impersonation phishing threat, specifically targeting users of the popular cryptocurrency wallet MetaMask. Registered on July 29, 2025, through West263 International Limited, this domain was designed to deceive visitors into believing it was an official MetaMask resource, as evidenced by its page title listing variations like "metamask下载", "metamask下载app", and "小狐狸app" (the Chinese nickname for MetaMask). The site posed a high risk due to its convincing impersonation and the sensitivity of the information it sought to harvest.

Technical analysis reveals several red flags. The domain resolves to IP address 148.178.96.67 and uses a Let's Encrypt SSL certificate (YR1), which is common among both legitimate and malicious sites. VirusTotal flagged it with 12 out of 95 security vendors marking it as malicious, indicating broad detection across the security community. Additionally, the domain appears on three security blocklists, further confirming its malicious nature. The registrar, West263 International Limited, is known for hosting questionable domains, and the recent creation date suggests a short-lived operation designed to evade detection.

As of the latest assessment, m.metmask.top has been taken offline, neutralizing the immediate threat. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends that anyone who may have interacted with this site should immediately change their MetaMask credentials and enable two-factor authentication. Always verify URLs by checking official sources and avoid downloading wallet applications from third-party sites. The proactive takedown of this domain demonstrates effective collaboration between security researchers and hosting providers, but continuous user education remains the best defense against such phishing campaigns.