metamask[.]web3-1[.]top

This domain impersonates MetaMask to trick users into exposing wallet credentials and seed phrases, a common tactic to drain cryptocurrency holdings. PhishDestroy identifies metamask.web3-1.top as a current threat under investigation, actively posing as the official MetaMask brand to deceive visitors seeking wallet login or extension downloads.

PhishDestroy confirms the threat level using concrete evidence: the domain was registered on April 01, 2026, through NameSilo, LLC, and currently shows 0 detections out of 95 VirusTotal scanners as of this assessment. Additionally, the domain resolves to IP 185.66.90.106 and has been blocked by MetaMask and SEAL, while appearing on 2 security blocklists. The SSL certificate issued by Let’s Encrypt provides a false sense of legitimacy, but the brand impersonation technique remains a primary danger here.

If you visited metamask.web3-1.top, do not enter any wallet passwords, seed phrases, or recovery keys. Disconnect from the site immediately and revoke any permissions you may have granted. Run a security scan on your device with updated antivirus software, and monitor your wallet transactions for unusual activity. Report the domain to MetaMask’s official phishing reporting channels and consider changing passwords for sensitive accounts if you reused credentials. Always verify the correct domain (metamask.io) by cross-checking with official MetaMask communications or using trusted bookmarks.