q3-based[.]top

Analysis indicates that q3-based.top remains an active phishing domain as of July 19, 2026, specifically targeting MetaMask users. Infrastructure analysis reveals the domain returns an HTTP 200 status, confirming it is live and serving content. It is flagged by three independent security blocklists—PhishDestroy, MetaMask’s internal threat feed, and SEAL—demonstrating cross-industry recognition of its malicious intent. Five of 91 security vendors on VirusTotal have detected the domain, further corroborating its classification as a phishing site. The exact content hosted on q3-based.top has not yet undergone full forensic analysis, so specific page elements, phishing kit signatures, or targeted brands beyond MetaMask cannot be confirmed. However, the domain’s presence on MetaMask’s blocklist strongly suggests it is designed to harvest cryptocurrency wallet credentials. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network layer. Security teams are advised to monitor for connections to q3-based.top in proxy logs and endpoint telemetry, as any interaction with this domain likely indicates an attempted credential compromise. No registration or hosting details are currently available to assess infrastructure longevity or attribution.