MetaMask logo

MetaMask phishing & impersonation

589
Sites impersonating it
24
New in the last 30 days
1
Campaigns
2026-11-14
Last detected
New sites per day, last 90 days487 new sites · busiest day 221
2026-08-29: 22 new sites2026-08-31: 1 new site2026-09-06: 3 new sites2026-09-07: 1 new site2026-09-10: 2 new sites2026-09-11: 1 new site2026-09-12: 1 new site2026-09-14: 1 new site2026-09-15: 1 new site2026-09-21: 1 new site2026-09-27: 50 new sites2026-09-28: 221 new sites2026-09-29: 136 new sites2026-09-30: 17 new sites2026-10-02: 1 new site2026-10-11: 1 new site2026-10-14: 1 new site2026-10-15: 2 new sites2026-10-17: 1 new site2026-10-20: 1 new site2026-10-22: 1 new site2026-10-24: 4 new sites2026-10-25: 7 new sites2026-10-26: 1 new site2026-10-27: 2 new sites2026-10-29: 1 new site2026-11-06: 1 new site2026-11-07: 1 new site2026-11-10: 1 new site2026-11-12: 2 new sites2026-11-13: 1 new site
2026-08-172026-11-14
Where these sites are hosted

571 on free hosting platforms, 18 on 8 registered domains

r2.dev · 548vercel.app · 17netlify.app · 2pages.dev · 2github.io · 1square.site · 1.com · 9.io · 7.site · 1.to · 1

Campaigns

Phishing kits we track as hunts, and how many of the sites below each one covers. A site can belong to more than one.

Official domains
metamask.io

A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.

Also known as
metamask web3 walletmetamask dapp browsermetamask walletmetamask pluginmetamask browser extensionmetamask crypto walletmetamask extension

Sites impersonating MetaMask

50 of 589 sites · newest first · repeat scans of a site are grouped

8 lower-risk copies are not shown: sites that use the MetaMask name or design, but that neither our rule engine nor our AI analysis rates high risk (for example harmless copies of the brand's own pages). Show them

2 further sites are not listed at all: the MetaMask name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).