Phishing sites impersonating MetaMask

PhishDestroy has recorded 6,882 phishing domains impersonating MetaMask since 2024-04-08, 1,104 of them in the last 30 days. The most used registrars are NICENIC and Cloudflare; the most common TLDs are .com and .app. The official MetaMask domain is metamask.io: any other site asking for your login or wallet is not MetaMask.

6,882
Domains, all time
1,104
Last 30 days
3,259
Online at last check
697
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 12026-07-26: 202026-07-27: 272026-07-28: 1472026-07-29: 192026-07-30: 592026-07-31: 292026-08-01: 412026-08-02: 332026-08-03: 362026-08-04: 942026-08-05: 392026-08-06: 162026-08-07: 302026-08-08: 112026-08-09: 512026-08-10: 902026-08-11: 252026-08-12: 612026-08-13: 422026-08-14: 812026-08-15: 732026-08-16: 492026-08-17: 672026-08-18: 1392026-08-19: 42026-08-20: 1632026-08-21: 672026-08-22: 842026-08-23: 642026-08-24: 142026-08-25: 392026-08-26: 1442026-08-27: 192026-08-28: 2112026-08-29: 132026-08-30: 32026-08-31: 1702026-09-01: 602026-09-02: 642026-09-03: 612026-09-04: 1362026-09-05: 382026-09-06: 202026-09-07: 192026-09-08: 402026-09-09: 192026-09-10: 62026-09-11: 742026-09-12: 52026-09-13: 102026-09-14: 372026-09-15: 632026-09-16: 22026-09-17: 342026-09-18: 12026-09-19: 52026-09-20: 52026-09-21: 22026-09-22: 02026-09-23: 562026-09-24: 32026-09-25: 512026-09-26: 32026-09-27: 982026-09-28: 42026-09-29: 1172026-09-30: 112026-10-01: 142026-10-02: 22026-10-03: 122026-10-04: 422026-10-05: 12026-10-06: 82026-10-07: 4792026-10-08: 362026-10-09: 102026-10-10: 62026-10-11: 662026-10-12: 12026-10-13: 372026-10-14: 92026-10-15: 92026-10-16: 162026-10-17: 92026-10-18: 02026-10-19: 42026-10-20: 02026-10-21: 02026-10-22: 0
MetaMask phishing domains detected per day: 4,080 from 2026-07-25 to 2026-10-22; peak 479.

How to tell a fake MetaMask site

Official domain: metamask.io.

Words most often added to the brand in reported domains: claim, login, rainbet, tron, meta, finance, usepaid, daftpage, wallet, typedream.

  • Type the address yourself or use a bookmark; phishing links for MetaMask arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • MetaMask will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest MetaMask phishing domains

The 50 most recently detected domains impersonating MetaMask
DomainFirst detectedStatus at last checkRegistrar
variationaltrade.com2026-10-19OnlineNameSilo
sharex-network.live2026-10-19OnlineNICENIC
aurexarcexperience.xyz2026-10-19OfflineDynadot
99-1.tapekit.org2026-10-19OnlineGoDaddy.com
askoro.digital2026-10-17OfflinePublicDomainRegistry.com
dapp.ocaccess.blog2026-10-17OnlineDynadot
dapp.ocaccess.live2026-10-17OnlineDynadot
formlyx.jp2026-10-17Online—
quicknode.vhuatu.com2026-10-17OfflineGname.com
quicknode.zikaoe.com2026-10-17OfflineGname.com
rainbetcanada.site2026-10-17OnlineRegistrar.eu
coingekco.cash2026-10-17OnlineDynadot
capitalboosts.org2026-10-17OnlineRegistrar of Domain Names REG.RU
bitbri-dgei.com2026-10-16OnlineGransy, s.r.o
ets211.com2026-10-16OfflineWeb Commerce Communications dba WebNic.c
sakurax.xyz2026-10-16OnlineGoDaddy.com
rainbitg.cc2026-10-16OnlineGname.com
tecomu.cc2026-10-16OnlineDynadot
prismassets.fun2026-10-16OfflineNICENIC
rewardsmask.app2026-10-16OfflineNameSilo
long8-yahoo.com.cn2026-10-16Online广东时代互联科技有限公司
com-gateway-api-gateway-dex-app.cloud2026-10-16OnlineWeb Commerce Communications
com-access-backup.com2026-10-16OfflineCNOBIN INFORMATION TECHNOLOGY
redotpaycn.com2026-10-16OfflineOnamae.com
pikashowweb.com2026-10-16OnlinePorkbun
arcportal.icu2026-10-16OfflinePublicDomainRegistry.com
getsecurecard.com2026-10-16OnlineNameCheap
papertradeinvitations.com2026-10-16OfflineNICENIC
us05-web-zoom.com2026-10-16OnlineNameCheap
metamaskteams.org2026-10-15OfflinePorkbun
login-atomic.com2026-10-15OnlineNICENIC
hoodpad.vip2026-10-15OnlineNameSilo
xn--pay-bitefill-ljc.com2026-10-15OnlineDYNADOT
mask-gift.com2026-10-15OnlineRealtime Register
pixel-llc.com2026-10-15OnlineCloudflare
onchainex.pw2026-10-15OnlineNameSilo
betpaributv20.com2026-10-15OnlineGoDaddy.com
bankrbott.xyz2026-10-15OfflineRegistrar.eu
quantumglobals.org2026-10-14OnlineGoDaddy.com
com-v3-swap-portal-gateway.cloud2026-10-14OnlineWeb Commerce Communications
cibit-v2.online2026-10-14OfflineRegistrar of Domain Names REG.RU
reenisinteriors.com2026-10-14OnlineGoDaddy.com
trx-rent.com.cn2026-10-14Online北京新网数码信息技术有限公司
vepoplumbers.com2026-10-14OnlineNAMECHEAP
mintandmetacred.xyz2026-10-14OnlineDynadot
connect-app.pro2026-10-14OnlineSpaceship
mescaz.com2026-10-14OnlineTrustname.com
app-nado.hyz-en.biz.id2026-10-13OnlinePT Jagoan Hosting Indonesia
cryptoairdropnews.vip2026-10-13OnlineDYNADOT
meetnewmeet.online2026-10-13OfflineNAMECHEAP

All 6,882 MetaMask reports

Where they are registered and hosted

Registrars

  1. NICENIC908
  2. Cloudflare540
  3. Netlify308
  4. NameSilo243
  5. Vercel238
  6. Dynadot231
  7. PublicDomainRegistry.com223
  8. GoDaddy.com218

Top-level domains

  1. .com1,859
  2. .app853
  3. .xyz701
  4. .io574
  5. .dev415
  6. .top170
  7. .net161
  8. .org151

Hosting networks

  1. Cloudflare, Inc.2,401
  2. CLOUDFLARENET, US807
  3. Amazon.com, Inc.745
  4. CLOUDFLARENET - Cloudflare, Inc., US427
  5. AS13335 Cloudflare, Inc.278
  6. AMAZON-02, US258
  7. Google LLC93
  8. Omegatech LTD85

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is MetaMask; share of all PhishDestroy reports: 3.06%.