# Phishing sites impersonating MetaMask

PhishDestroy has recorded 6,882 phishing domains impersonating MetaMask since 2024-04-08, 1,104 of them in the last 30 days. The most used registrars are NICENIC and Cloudflare; the most common TLDs are .com and .app. The official MetaMask domain is metamask.io: any other site asking for your login or wallet is not MetaMask.

6,882Domains, all time

1,104Last 30 days

3,259Online at last check

697Confirmed takedowns

## New domains in the last 90 days

MetaMask phishing domains detected per day: 4,080 from 2026-07-25 to 2026-10-22; peak 479.

## How to tell a fake MetaMask site

Official domain: metamask.io.

Words most often added to the brand in reported domains: claim, login, rainbet, tron, meta, finance, usepaid, daftpage, wallet, typedream.
- Type the address yourself or use a bookmark; phishing links for MetaMask arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- MetaMask will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest MetaMask phishing domains

The 50 most recently detected domains impersonating MetaMask
Domain | First detected | Status at last check | Registrar | 
[variationaltrade.com](https://phishdestroy.io/domain/variationaltrade.com/) | 2026-10-19 | Online | NameSilo | 
[sharex-network.live](https://phishdestroy.io/domain/sharex-network.live/) | 2026-10-19 | Online | NICENIC | 
[aurexarcexperience.xyz](https://phishdestroy.io/domain/aurexarcexperience.xyz/) | 2026-10-19 | Offline | Dynadot | 
[99-1.tapekit.org](https://phishdestroy.io/domain/99-1.tapekit.org/) | 2026-10-19 | Online | GoDaddy.com | 
[askoro.digital](https://phishdestroy.io/domain/askoro.digital/) | 2026-10-17 | Offline | PublicDomainRegistry.com | 
[dapp.ocaccess.blog](https://phishdestroy.io/domain/dapp.ocaccess.blog/) | 2026-10-17 | Online | Dynadot | 
[dapp.ocaccess.live](https://phishdestroy.io/domain/dapp.ocaccess.live/) | 2026-10-17 | Online | Dynadot | 
[formlyx.jp](https://phishdestroy.io/domain/formlyx.jp/) | 2026-10-17 | Online | — | 
[quicknode.vhuatu.com](https://phishdestroy.io/domain/quicknode.vhuatu.com/) | 2026-10-17 | Offline | Gname.com | 
[quicknode.zikaoe.com](https://phishdestroy.io/domain/quicknode.zikaoe.com/) | 2026-10-17 | Offline | Gname.com | 
[rainbetcanada.site](https://phishdestroy.io/domain/rainbetcanada.site/) | 2026-10-17 | Online | Registrar.eu | 
[coingekco.cash](https://phishdestroy.io/domain/coingekco.cash/) | 2026-10-17 | Online | Dynadot | 
[capitalboosts.org](https://phishdestroy.io/domain/capitalboosts.org/) | 2026-10-17 | Online | Registrar of Domain Names REG.RU | 
[bitbri-dgei.com](https://phishdestroy.io/domain/bitbri-dgei.com/) | 2026-10-16 | Online | Gransy, s.r.o | 
[ets211.com](https://phishdestroy.io/domain/ets211.com/) | 2026-10-16 | Offline | Web Commerce Communications dba WebNic.c | 
[sakurax.xyz](https://phishdestroy.io/domain/sakurax.xyz/) | 2026-10-16 | Online | GoDaddy.com | 
[rainbitg.cc](https://phishdestroy.io/domain/rainbitg.cc/) | 2026-10-16 | Online | Gname.com | 
[tecomu.cc](https://phishdestroy.io/domain/tecomu.cc/) | 2026-10-16 | Online | Dynadot | 
[prismassets.fun](https://phishdestroy.io/domain/prismassets.fun/) | 2026-10-16 | Offline | NICENIC | 
[rewardsmask.app](https://phishdestroy.io/domain/rewardsmask.app/) | 2026-10-16 | Offline | NameSilo | 
[long8-yahoo.com.cn](https://phishdestroy.io/domain/long8-yahoo.com.cn/) | 2026-10-16 | Online | 广东时代互联科技有限公司 | 
[com-gateway-api-gateway-dex-app.cloud](https://phishdestroy.io/domain/com-gateway-api-gateway-dex-app.cloud/) | 2026-10-16 | Online | Web Commerce Communications | 
[com-access-backup.com](https://phishdestroy.io/domain/com-access-backup.com/) | 2026-10-16 | Offline | CNOBIN INFORMATION TECHNOLOGY | 
[redotpaycn.com](https://phishdestroy.io/domain/redotpaycn.com/) | 2026-10-16 | Offline | Onamae.com | 
[pikashowweb.com](https://phishdestroy.io/domain/pikashowweb.com/) | 2026-10-16 | Online | Porkbun | 
[arcportal.icu](https://phishdestroy.io/domain/arcportal.icu/) | 2026-10-16 | Offline | PublicDomainRegistry.com | 
[getsecurecard.com](https://phishdestroy.io/domain/getsecurecard.com/) | 2026-10-16 | Online | NameCheap | 
[papertradeinvitations.com](https://phishdestroy.io/domain/papertradeinvitations.com/) | 2026-10-16 | Offline | NICENIC | 
[us05-web-zoom.com](https://phishdestroy.io/domain/us05-web-zoom.com/) | 2026-10-16 | Online | NameCheap | 
[metamaskteams.org](https://phishdestroy.io/domain/metamaskteams.org/) | 2026-10-15 | Offline | Porkbun | 
[login-atomic.com](https://phishdestroy.io/domain/login-atomic.com/) | 2026-10-15 | Online | NICENIC | 
[hoodpad.vip](https://phishdestroy.io/domain/hoodpad.vip/) | 2026-10-15 | Online | NameSilo | 
[xn--pay-bitefill-ljc.com](https://phishdestroy.io/domain/xn--pay-bitefill-ljc.com/) | 2026-10-15 | Online | DYNADOT | 
[mask-gift.com](https://phishdestroy.io/domain/mask-gift.com/) | 2026-10-15 | Online | Realtime Register | 
[pixel-llc.com](https://phishdestroy.io/domain/pixel-llc.com/) | 2026-10-15 | Online | Cloudflare | 
[onchainex.pw](https://phishdestroy.io/domain/onchainex.pw/) | 2026-10-15 | Online | NameSilo | 
[betpaributv20.com](https://phishdestroy.io/domain/betpaributv20.com/) | 2026-10-15 | Online | GoDaddy.com | 
[bankrbott.xyz](https://phishdestroy.io/domain/bankrbott.xyz/) | 2026-10-15 | Offline | Registrar.eu | 
[quantumglobals.org](https://phishdestroy.io/domain/quantumglobals.org/) | 2026-10-14 | Online | GoDaddy.com | 
[com-v3-swap-portal-gateway.cloud](https://phishdestroy.io/domain/com-v3-swap-portal-gateway.cloud/) | 2026-10-14 | Online | Web Commerce Communications | 
[cibit-v2.online](https://phishdestroy.io/domain/cibit-v2.online/) | 2026-10-14 | Offline | Registrar of Domain Names REG.RU | 
[reenisinteriors.com](https://phishdestroy.io/domain/reenisinteriors.com/) | 2026-10-14 | Online | GoDaddy.com | 
[trx-rent.com.cn](https://phishdestroy.io/domain/trx-rent.com.cn/) | 2026-10-14 | Online | 北京新网数码信息技术有限公司 | 
[vepoplumbers.com](https://phishdestroy.io/domain/vepoplumbers.com/) | 2026-10-14 | Online | NAMECHEAP | 
[mintandmetacred.xyz](https://phishdestroy.io/domain/mintandmetacred.xyz/) | 2026-10-14 | Online | Dynadot | 
[connect-app.pro](https://phishdestroy.io/domain/connect-app.pro/) | 2026-10-14 | Online | Spaceship | 
[mescaz.com](https://phishdestroy.io/domain/mescaz.com/) | 2026-10-14 | Online | Trustname.com | 
[app-nado.hyz-en.biz.id](https://phishdestroy.io/domain/app-nado.hyz-en.biz.id/) | 2026-10-13 | Online | PT Jagoan Hosting Indonesia | 
[cryptoairdropnews.vip](https://phishdestroy.io/domain/cryptoairdropnews.vip/) | 2026-10-13 | Online | DYNADOT | 
[meetnewmeet.online](https://phishdestroy.io/domain/meetnewmeet.online/) | 2026-10-13 | Offline | NAMECHEAP | 

[All 6,882 MetaMask reports](https://phishdestroy.io/domain/?brand=MetaMask)

## Where they are registered and hosted

### Registrars

- [NICENIC](https://phishdestroy.io/registrar/nicenic/)908
- Cloudflare540
- Netlify308
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)243
- Vercel238
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)231
- [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)223
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)218

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)1,859
- [.app](https://phishdestroy.io/tld/app/)853
- [.xyz](https://phishdestroy.io/tld/xyz/)701
- [.io](https://phishdestroy.io/tld/io/)574
- [.dev](https://phishdestroy.io/tld/dev/)415
- [.top](https://phishdestroy.io/tld/top/)170
- [.net](https://phishdestroy.io/tld/net/)161
- [.org](https://phishdestroy.io/tld/org/)151

### Hosting networks

- Cloudflare, Inc.2,401
- CLOUDFLARENET, US807
- Amazon.com, Inc.745
- CLOUDFLARENET - Cloudflare, Inc., US427
- AS13335 Cloudflare, Inc.278
- AMAZON-02, US258
- Google LLC93
- Omegatech LTD85

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/)
- [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is MetaMask; share of all PhishDestroy reports: 3.06%.

Canonical: https://phishdestroy.io/brand/metamask/