MetaMask

Crypto & web3 United Statesmetamask.ioRank 39 of the most impersonated
Cert findings · 24 h
7
Cert findings · 7 days
42
34 reported or listed · 8 on phishing hosts
Registered lookalikes
218
85 listed by a source or an address list
Official domains
6
verified from MetaMask's own sites and records

Certificate findings for MetaMask

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to MetaMask's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 79 findings, grouped by hostname

  1. meta-mask-wallet-912.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    meta-mask-wallet-912.pages.dev
    First seen
    2026-11-05 07:20 UTC
    First published
    2026-11-05 07:32 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:44 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 06:19 UTC to 2027-02-03 07:17 UTC
    Logged 2026-11-05 07:19 UTC in Google PlumbersArms2027h1, entry 622,140,040
    SHA-256 a45d97078c904aae1f032f59b3d5083b9951b24408108c2d64d9d85eb2b003c2
    Public key SHA-256 2d27baa3430275e8498334805d03c43a1624787363570416b6b6256f49a4323a
    Brand
    MetaMask
    Addresses
    172.66.45.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.220 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d24
    2606:4700:310c::ac42:2edc
    Cloudflare
    Cloudflare (172.66.45.36, 172.66.46.220): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  2. www.metamask.us US · AS16509 · Amazon.com, Inc.2 addresses
    ListedParking page · AfternicUnder metamask.us, listed by MetaMaskMX absentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.metamask.us
    First seen
    2026-11-05 07:10 UTC
    First published
    2026-11-05 07:32 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:44 UTC
    Listed
    MetaMask, listing metamask.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-11-05 07:05 UTC to 2027-05-22 07:05 UTC
    Logged 2026-11-05 07:05 UTC in GoDaddy Aquamarine2027h1, entry 182,668,319
    SHA-256 63c23540a1bdb624e8a955248a268e91b0c87068f3871ff3ced4b7164a2c081c
    Public key SHA-256 bb1cf7f91c939adf159106912809de05916bad41b494400dc53f9a5d3b0a852e
    Brand
    MetaMask
    Addresses
    13.248.169.48 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    76.223.54.146 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    Parking page · Afternic
    The registry delegates metamask.us to Afternic’s nameservers, which answer for it. Afternic (13.248.169.48, 76.223.54.146): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamask.us
    Registered
    2023-06-26 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 07:10 UTC

    Suggest a correction

  3. metamaskhelp.app US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by MetaMaskMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    metamaskhelp.app
    First seen
    2026-11-05 05:10 UTC
    First published
    2026-11-05 05:17 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-28 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:23 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 04:07 UTC to 2027-02-03 04:07 UTC
    Logged 2026-11-05 05:05 UTC in IPng Networks Halloumi2027h1, entry 369,916,112
    SHA-256 4a175b32bcd8613cac8411871cc82fa88860543ae78df689e44efc4b04df8ebd
    Public key SHA-256 5c9f7769923125253d20df423026b2ed7f306c2160fa8215ea4254d6f5b860e8
    Brand
    MetaMask
    Addresses
    207.207.210.107 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    207.207.210.229 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (207.207.210.107, 207.207.210.229): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamaskhelp.app
    Registered
    2025-10-14 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:16 UTC

    Suggest a correction

  4. www.meta-mask-compliance.de CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    www.meta-mask-compliance.de
    First seen
    2026-11-05 04:15 UTC
    First published
    2026-11-05 05:17 UTC
    DNS
    Resolves · checked 2026-11-05 05:23 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-05 03:02 UTC to 2027-02-03 03:02 UTC
    Logged 2026-11-05 04:02 UTC in DigiCert Sphinx2027h1, entry 362,656,031
    SHA-256 7fd4baf115b5cc5a5acc94d4426071205273cfd6c92de445c011c6a9e5e55c2b
    Public key SHA-256 f7fe5c4661fbbb75462680464edb740ec491054632757e273dedcbb318b64172
    Brand
    MetaMask
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    meta-mask-compliance.de
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 04:17 UTC

    Suggest a correction

  5. meta-mask-compliance.de CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    meta-mask-compliance.de
    First seen
    2026-11-05 04:15 UTC
    First published
    2026-11-05 05:17 UTC
    DNS
    Resolves · checked 2026-11-05 05:23 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-05 03:02 UTC to 2027-02-03 03:02 UTC
    Logged 2026-11-05 04:02 UTC in DigiCert Sphinx2027h1, entry 362,656,031
    SHA-256 7fd4baf115b5cc5a5acc94d4426071205273cfd6c92de445c011c6a9e5e55c2b
    Public key SHA-256 f7fe5c4661fbbb75462680464edb740ec491054632757e273dedcbb318b64172
    Brand
    MetaMask
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    meta-mask-compliance.de
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 04:17 UTC

    Suggest a correction

  6. www.card-metamask.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder card-metamask.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.card-metamask.com
    First seen
    2026-11-05 00:35 UTC
    First published
    2026-11-05 00:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Listed
    MetaMask, listing card-metamask.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 23:35 UTC to 2027-02-02 23:35 UTC
    Logged 2026-11-05 00:34 UTC in Geomys Tuscolo2027h1, entry 479,870,758
    SHA-256 415dbb17245b3ff50564614b3f2f32ee89e460d4c5204390de3a7dd7ec6b4a3f
    Public key SHA-256 ef7ccee48bd47e9791b814ae6a9983b3cc7c03bb40bc55a048ff1899b2b16df3
    Brand
    MetaMask
    Addresses
    104.21.7.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.135.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:87f8
    2606:4700:3037::6815:78a
    Cloudflare
    Cloudflare (104.21.7.138, 172.67.135.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    card-metamask.com
    Registered
    2026-07-07 · Internet Domain Service BS Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  7. autoguard-metamask-app.metamasksecurity.workers.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    autoguard-metamask-app.metamasksecurity.workers.dev
    First seen
    2026-11-04 15:05 UTC
    First published
    2026-11-04 15:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:48 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-04 14:04 UTC to 2027-02-02 14:59 UTC
    Logged 2026-11-04 15:04 UTC in Google PlumbersArms2027h1, entry 610,573,304
    SHA-256 ea617c3f507dd9efaef5f72c1aad134878accfae73adeccf2177ce5723cbafd8
    Public key SHA-256 b330c446f34ee091b59ff544db842e95158cdc6147d22bfb0ab54b2a83de0b09
    Brand
    MetaMask
    Addresses
    104.21.47.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.143.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:8fc5
    2606:4700:3035::6815:2f11
    Cloudflare
    Cloudflare (104.21.47.17, 172.67.143.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  8. www.cn-metamask.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    www.cn-metamask.com
    First seen
    2026-11-04 09:03 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    cn-metamask.com
    Registered
    2025-09-12 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  9. m.cn-metamask.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    m.cn-metamask.com
    First seen
    2026-11-04 08:58 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    cn-metamask.com
    Registered
    2025-09-12 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  10. cn-metamask.com HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 14 mo ago
    DetailsHide
    Hostname
    cn-metamask.com
    First seen
    2026-11-04 08:58 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Resolved to 206.161.218.138
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    cn-metamask.com
    Registered
    2025-09-12 · Cloud Yuqu LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  11. metamask-cryptoforestxe.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    metamask-cryptoforestxe.com
    First seen
    2026-11-04 05:41 UTC
    First published
    2026-11-04 06:49 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 07:06 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 04:39 UTC to 2027-02-02 04:39 UTC
    Logged 2026-11-04 05:38 UTC in Geomys Tuscolo2027h1, entry 468,991,130
    SHA-256 81ec97088cc3b106b98f0c7decfc7bca9f16dc43e131fca428140fe728c75df7
    Public key SHA-256 835623f7efc49f13b788e5f7f74bf383b140d9ace0f427c1f996dbcd04923622
    Brand
    MetaMask
    Domain
    metamask-cryptoforestxe.com
    Registered
    2026-05-10 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:45 UTC

    Suggest a correction

  12. identification-metamask.io US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 18 d ago
    DetailsHide
    Hostname
    identification-metamask.io
    First seen
    2026-11-04 03:21 UTC
    First published
    2026-11-04 04:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-01-19 05:47 UTC
    Logged 2026-11-04 03:20 UTC in Geomys Tuscolo2027h1, entry 467,714,232
    SHA-256 32d6a565ce8b2c64a962d7d4a9e4b2eb1e892d46acb615fdb3d0379124fb5df1
    Public key SHA-256 5ef41027f02d7117dd12ba9dffef2bf6346e06ffd5389b933d004e53035e758f
    Brand
    MetaMask
    Addresses
    104.21.2.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.226 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::ac43:80e2
    2606:4700:3036::6815:24a
    Cloudflare
    Cloudflare (104.21.2.74, 172.67.128.226): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    identification-metamask.io
    Registered
    2026-10-18 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:28 UTC

    Suggest a correction

  13. www.metamask-web3.com.cn HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.metamask-web3.com.cn
    First seen
    2026-11-04 00:07 UTC
    First published
    2026-11-04 00:32 UTC
    DNS
    Resolves · checked 2026-11-05 00:46 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL RSA DV SSL CA 2 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-02-02 23:59 UTC
    Logged 2026-11-04 00:03 UTC in Let's Encrypt Sycamore2027h1, entry 931,087,561
    SHA-256 406d9bb4b9aeb903347ec23e5cfaf848c7be2c6e7ce999e4652bc38af645ec36
    Public key SHA-256 c3a1f9f84f71b3871bc3d5343188aac48f61f1df7395bd487a36c817ce24a946
    Brand
    MetaMask
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    metamask-web3.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  14. metamask-web3.com.cn HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    metamask-web3.com.cn
    First seen
    2026-11-04 00:06 UTC
    First published
    2026-11-04 00:32 UTC
    DNS
    Resolves · checked 2026-11-05 00:46 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL RSA DV SSL CA 2 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-02-02 23:59 UTC
    Logged 2026-11-04 00:03 UTC in Let's Encrypt Sycamore2027h1, entry 931,087,561
    SHA-256 406d9bb4b9aeb903347ec23e5cfaf848c7be2c6e7ce999e4652bc38af645ec36
    Public key SHA-256 c3a1f9f84f71b3871bc3d5343188aac48f61f1df7395bd487a36c817ce24a946
    Brand
    MetaMask
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    metamask-web3.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  15. m.metamask-web3.com.cn HK · AS135357 · HONG KONG KOWLOON TELECOMMU…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    m.metamask-web3.com.cn
    First seen
    2026-11-04 00:06 UTC
    First published
    2026-11-04 00:32 UTC
    DNS
    Resolves · checked 2026-11-05 00:45 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 206.161.218.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 206.161.218.138
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL RSA DV SSL CA 2 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-02-02 23:59 UTC
    Logged 2026-11-04 00:03 UTC in Let's Encrypt Sycamore2027h1, entry 931,087,561
    SHA-256 406d9bb4b9aeb903347ec23e5cfaf848c7be2c6e7ce999e4652bc38af645ec36
    Public key SHA-256 c3a1f9f84f71b3871bc3d5343188aac48f61f1df7395bd487a36c817ce24a946
    Brand
    MetaMask
    Addresses
    206.161.218.138 · Hong Kong · AS135357 PCCW22-HK - HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED
    Domain
    metamask-web3.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  16. metamask-verify.net US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    metamask-verify.net
    First seen
    2026-11-03 23:50 UTC
    First published
    2026-11-04 00:32 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-03 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 00:46 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 23:55 UTC to 2027-01-31 23:55 UTC
    Logged 2026-11-03 00:53 UTC in IPng Networks Gouda2027h1, entry 297,824,393
    SHA-256 664c4faa6298a1f39b755da11d12c27ef106f5108001837bdd0ee48710faea0b
    Public key SHA-256 8c5453edffd9eb4845cc251bb74bb8ef29622d00b9fccbcdb1a7ab0d9c83ac16
    Brand
    MetaMask
    Addresses
    104.21.43.26 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.51 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:d833
    2606:4700:3037::6815:2b1a
    Cloudflare
    Cloudflare (104.21.43.26, 172.67.216.51): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask-verify.net
    Registered
    2026-11-03 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  17. metamask-cryptoforestgt.com
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    metamask-cryptoforestgt.com
    First seen
    2026-11-03 21:56 UTC
    First published
    2026-11-03 22:18 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-04 22:31 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 20:57 UTC to 2027-02-01 20:57 UTC
    Logged 2026-11-03 21:55 UTC in Let's Encrypt Willow2027h1, entry 921,154,275
    SHA-256 1595b29457086d36e3dc11735bb15f2cae3042b44235b96e50e76885a02d8883
    Public key SHA-256 550415713e71edca4ef57739888c114d99df9a4d0558d99c13993c41efdb9c34
    Brand
    MetaMask
    Domain
    metamask-cryptoforestgt.com
    Registered
    2026-05-10 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  18. metamask.pro US · AS16509 · Amazon.com, Inc.3 addresses
    ListedAmazon Web ServicesListed by MetaMaskMX absentSPF missingDMARC missingRegistered 20 mo ago
    DetailsHide
    Hostname
    metamask.pro
    First seen
    2026-11-03 19:00 UTC
    First published
    2026-11-03 19:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 19:33 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 17:56 UTC to 2027-02-01 17:56 UTC
    Logged 2026-11-03 18:55 UTC in DigiCert Wyvern2027h1, entry 392,258,314
    SHA-256 293d93b7d2f0af4b66490642c23e732d1a516a50dbfe46186c9ca48f8e0c9ccb
    Public key SHA-256 bb80660e97542a284ddd1de6e7be7ed9a594335d00058366bc9986288d276b68
    Brand
    MetaMask
    Addresses
    207.207.210.23 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    207.207.210.36 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    207.207.210.50 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (207.207.210.23, 207.207.210.36, 207.207.210.50): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamask.pro
    Registered
    2025-03-23 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  19. metamask-recover.help GB · AS212238 · CDNEXT Datacamp Limited
    ListedListed by MetaMaskMX presentSPF -allDMARC quarantineRegistered 3 d ago
    DetailsHide
    Hostname
    metamask-recover.help
    First seen
    2026-11-03 17:49 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-03 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-03 14:00 UTC to 2027-02-01 14:00 UTC
    Logged 2026-11-03 14:59 UTC in DigiCert Wyvern2027h1, entry 389,874,989
    SHA-256 8a3bf5a96d5acf964ce53da47c17943ba46fceba6122cea21b219b7a0e1913fd
    Public key SHA-256 a691a8dd525f4b7ae574ff1f6ab0135a2ca1d585b421aec6736b8a9b23b063e8
    Brand
    MetaMask
    Addresses
    209.92.170.223 · United Kingdom · AS212238 CDNEXT Datacamp Limited
    Domain
    metamask-recover.help
    Registered
    2026-11-02 · NameSilo, LLC
    MX
    Receives mail at mail.metamask-recover.help
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  20. metamask.work US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by MetaMaskMX presentSPF -allDMARC quarantineRegistered 22 mo ago
    DetailsHide
    Hostname
    metamask.work
    First seen
    2026-11-03 13:36 UTC
    First published
    2026-11-03 14:30 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 14:33 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-03 13:33 UTC to 2027-05-20 13:33 UTC
    Logged 2026-11-03 13:33 UTC in Google Argon2027h1, entry 841,338,097
    SHA-256 2d6930b1076851fa0214bb4e85a16eee98ce871b210d7191f9ea6b8a7851850c
    Public key SHA-256 36992a4fdaedab7ee5c3debf658461b5ff0b23dd0f3a0ec0fb70a19d5d989e06
    Brand
    MetaMask
    Addresses
    13.248.243.5 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.105.230 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.243.5, 76.223.105.230): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamask.work
    Registered
    2025-01-02 · GoDaddy.com, LLC
    MX
    Receives mail at metamask-work.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  21. www.metamask.work US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesUnder metamask.work, listed by MetaMaskMX presentSPF -allDMARC quarantineRegistered 22 mo ago
    DetailsHide
    Hostname
    www.metamask.work
    First seen
    2026-11-03 13:36 UTC
    First published
    2026-11-03 14:30 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 14:33 UTC
    Listed
    MetaMask, listing metamask.work and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-11-03 13:33 UTC to 2027-05-20 13:33 UTC
    Logged 2026-11-03 13:33 UTC in Google Argon2027h1, entry 841,338,097
    SHA-256 2d6930b1076851fa0214bb4e85a16eee98ce871b210d7191f9ea6b8a7851850c
    Public key SHA-256 36992a4fdaedab7ee5c3debf658461b5ff0b23dd0f3a0ec0fb70a19d5d989e06
    Brand
    MetaMask
    Addresses
    13.248.243.5 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.105.230 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.243.5, 76.223.105.230): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamask.work
    Registered
    2025-01-02 · GoDaddy.com, LLC
    MX
    Receives mail at metamask-work.mail.protection.outlook.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  22. 9cel.metamaskweb.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under metamaskweb.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    9cel.metamaskweb.com
    First seen
    2026-11-03 10:35 UTC
    First published
    2026-11-03 11:04 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:13 UTC
    Listed
    MetaMask, listing metamaskweb.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 09:34 UTC to 2027-02-01 09:34 UTC
    Logged 2026-11-03 10:33 UTC in Let's Encrypt Willow2027h1, entry 911,815,788
    SHA-256 84a294f3aae43c38b7f05afef6168daeae63bb2540cf0e2e6a967755c1118b48
    Public key SHA-256 0f43122657a1ab0c8b99d53e848c5d24fc988e81a766ef9919390b0ca47e2c8a
    Brand
    MetaMask
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamaskweb.com
    Registered
    2025-12-15 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  23. metamask.blog US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 2 d ago
    DetailsHide
    Hostname
    metamask.blog
    First seen
    2026-11-03 02:26 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 01:26 UTC to 2027-02-01 01:26 UTC
    Logged 2026-11-03 02:24 UTC in Google ParcelYard2027h1, entry 582,370,647
    SHA-256 6b6dc6859bd76ca354a18bfcfd15299e94d9a85556ec0cc6916cb1ade3a312fc
    Public key SHA-256 f80e33d5c65a33e8ad6b361ec6b448160831787eaf5d5282371fcbde7b648994
    Brand
    MetaMask
    Addresses
    104.21.37.155 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.81 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3036::6815:259b
    2606:4700:3037::ac43:d251
    Cloudflare
    Cloudflare (104.21.37.155, 172.67.210.81): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.blog
    Registered
    2026-11-03 · Dynadot LLC
    MX
    Receives mail at webhost.dynadot.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  24. metamask-airdrop.xyz
    ListedListed by MetaMaskRegistered 3 d ago
    DetailsHide
    Hostname
    metamask-airdrop.xyz
    First seen
    2026-11-02 23:48 UTC
    First published
    2026-11-03 00:09 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Checked · checked 2026-11-05 00:16 UTC
    Checks
    Overdue since 2026-11-03 00:15 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 13:33 UTC to 2027-01-31 13:33 UTC
    Logged 2026-11-02 14:31 UTC in Let's Encrypt Willow2027h1, entry 897,697,469
    SHA-256 4d53cbe0a7e5f0df3eda46ef381cea9cc357dea3642a333fbda209c7d150f095
    Public key SHA-256 f5d88143d9c4aa3b7196158dc9a3051be191d2f86e96f1a762dae8897b884c30
    Brand
    MetaMask
    Domain
    metamask-airdrop.xyz
    Registered
    2026-11-02 · Eranet International Limited
    Checked
    2026-11-03 00:08 UTC

    Suggest a correction

  25. card-metamask.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    card-metamask.com
    First seen
    2026-11-02 23:36 UTC
    First published
    2026-11-03 00:09 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 22:35 UTC to 2027-01-31 23:33 UTC
    Logged 2026-11-02 23:35 UTC in Google ParcelYard2027h1, entry 580,328,089
    SHA-256 b7587ed80e94c664b38e77034b3be194cabada0e232d43a491bdc13cdf002fb2
    Public key SHA-256 b805df84f87bf29182fa2ccdb134f4e1fce91d355ca62f92508cbcfad23b180e
    Brand
    MetaMask
    Addresses
    104.21.7.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.135.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:87f8
    2606:4700:3037::6815:78a
    Cloudflare
    Cloudflare (104.21.7.138, 172.67.135.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    card-metamask.com
    Registered
    2026-07-07 · Internet Domain Service BS Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  26. login-metamask.top US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    login-metamask.top
    First seen
    2026-11-02 15:51 UTC
    First published
    2026-11-02 16:54 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 16:58 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-02 00:00 UTC to 2027-01-28 08:09 UTC
    Logged 2026-11-02 15:46 UTC in Geomys Tuscolo2027h1, entry 447,063,022
    SHA-256 3407b151a58e2281cde549db6e1d517bac335c4c25062bbc5007308c8d460af1
    Public key SHA-256 e54da933ebea38ab6af5634d8f6a0954fd91b7f40ff6ec2192435f9e4dae3cac
    PhishDestroy
    Brand
    MetaMask
    Addresses
    104.21.11.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.185 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:b65
    2606:4700:3032::ac43:a5b9
    Cloudflare
    Cloudflare (104.21.11.101, 172.67.165.185): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    login-metamask.top
    Registered
    2026-03-20 · NameSilo,LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:30 UTC

    Suggest a correction

  27. metamask.software US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    metamask.software
    First seen
    2026-11-02 03:20 UTC
    First published
    2026-11-02 04:28 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:42 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 02:18 UTC to 2027-01-31 02:18 UTC
    Logged 2026-11-02 03:17 UTC in IPng Networks Halloumi2027h1, entry 334,889,694
    SHA-256 0ed1605df0b9aa1d159c679247ee3ce1bc0a383e76dea20c6ab9401746951e6e
    Public key SHA-256 85156ade5c81f7deb88b378419bacab945592b30bfdae5021fe06a1e829f2a77
    Brand
    MetaMask
    Addresses
    104.21.53.252 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.221.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:35fc
    2606:4700:3030::ac43:dda4
    Cloudflare
    Cloudflare (104.21.53.252, 172.67.221.164): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.software
    Registered
    2026-11-02 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  28. metamask.solutions US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    metamask.solutions
    First seen
    2026-11-01 17:41 UTC
    First published
    2026-11-01 18:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:08 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-01 00:00 UTC to 2027-01-28 13:52 UTC
    Logged 2026-11-01 17:36 UTC in Let's Encrypt Willow2027h1, entry 883,146,935
    SHA-256 2f324cb11153a938be89a00f8b985b3fb6d580e9e55400ac9c70af226dc91ac4
    Public key SHA-256 085c7beed11c0042a3828977accc567f76ea8d15c32720216417013c4d7efcfc
    Brand
    MetaMask
    Addresses
    104.21.35.27 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:231b
    2606:4700:3033::ac43:d448
    Cloudflare
    Cloudflare (104.21.35.27, 172.67.212.72): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.solutions
    Registered
    2026-06-05 · Cloudflare, Inc
    MX
    Receives mail at _dc-mx.e5e6de07db38.metamask.solutions
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  29. metamask-card.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    metamask-card.com
    First seen
    2026-11-01 14:11 UTC
    First published
    2026-11-01 15:18 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:31 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-01 00:00 UTC to 2027-01-17 07:53 UTC
    Logged 2026-11-01 14:06 UTC in Geomys Tuscolo2027h1, entry 433,238,430
    SHA-256 07720d0c14a5aa982695f246538f3f902694ab3591beb6ca0306b3fa90938afe
    Public key SHA-256 568e9ae5ba0902e50ac5108568d97a7a779fb5f201eaba0af5b2959e792dfc8a
    Brand
    MetaMask
    Addresses
    104.21.41.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:2994
    2606:4700:3035::ac43:93a8
    Cloudflare
    Cloudflare (104.21.41.148, 172.67.147.168): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask-card.com
    Registered
    2026-03-20 · Realtime Register B.V.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  30. www.metamask.win US · AS14956 · RouterHosting LLC
    ListedUnder metamask.win, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    www.metamask.win
    First seen
    2026-11-01 12:57 UTC
    First published
    2026-11-01 13:04 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:09 UTC
    Listed
    MetaMask, listing metamask.win and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 11:55 UTC to 2027-01-30 11:55 UTC
    Logged 2026-11-01 12:54 UTC in Google PlumbersArms2027h1, entry 556,056,720
    SHA-256 7a28e3a19dfb4c148ca82d5bfee9013488f4a76a9f1b0bc2894e39d9728a7cb4
    Public key SHA-256 d26ea989e957bcadeed7955574590bea2f5892e430625958b6bba30ac7b418d9
    Brand
    MetaMask
    Addresses
    104.194.152.193 · United States · AS14956 ROUTERHOSTING - RouterHosting LLC
    Domain
    metamask.win
    Registered
    2026-10-28 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:33 UTC

    Suggest a correction

  31. admin.metamask.win US · AS14956 · RouterHosting LLC
    ListedUnder metamask.win, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    admin.metamask.win
    First seen
    2026-11-01 12:51 UTC
    First published
    2026-11-01 13:04 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:09 UTC
    Listed
    MetaMask, listing metamask.win and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-01 11:48 UTC to 2027-01-30 11:47 UTC
    Logged 2026-11-01 12:46 UTC in IPng Networks Gouda2027h1, entry 285,716,685
    SHA-256 90455a661d85c086df566b632b69f6b9d50b86cd2f5a4e709c1afdd02aad5402
    Public key SHA-256 22d12585202b5fe482894c8351b7436baf653ad9bac44747a55f1f5a4f036d79
    Brand
    MetaMask
    Addresses
    104.194.152.193 · United States · AS14956 ROUTERHOSTING - RouterHosting LLC
    Domain
    metamask.win
    Registered
    2026-10-28 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:33 UTC

    Suggest a correction

  32. gwxmj3b.metamaskwalletweb3.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under metamaskwalletweb3.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    gwxmj3b.metamaskwalletweb3.com
    First seen
    2026-11-01 03:20 UTC
    First published
    2026-11-01 03:57 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:01 UTC
    Listed
    MetaMask, listing metamaskwalletweb3.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-01 02:20 UTC to 2027-01-30 02:20 UTC
    Logged 2026-11-01 03:19 UTC in Geomys Tuscolo2027h1, entry 427,826,240
    SHA-256 3e0d2f03d8876e3e085a5978a5c7ba699434220c279cf4dfffd44909340fcf28
    Public key SHA-256 c76f1bce171c02866656e2222b03a9d1605c1ac36cccd993b38dd6e933f84e14
    Brand
    MetaMask
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamaskwalletweb3.com
    Registered
    2026-06-05 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  33. www.metamask.community US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder metamask.community, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    www.metamask.community
    First seen
    2026-11-01 01:00 UTC
    First published
    2026-11-01 01:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 01:39 UTC
    Listed
    MetaMask, listing metamask.community and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-10-31 23:58 UTC to 2027-01-30 00:57 UTC
    Logged 2026-11-01 00:58 UTC in Google PlumbersArms2027h1, entry 548,424,089
    SHA-256 3f47b7ad4880e6122ccad972596ef2b8d21e78c28729dce606f279836e2a10a3
    Public key SHA-256 06d1c924a7785db037626bf2f414ae9286160f086ef55a75ea10c571bfb2ecce
    Brand
    MetaMask
    Addresses
    23.227.38.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2620:127:f00f:e::
    Cloudflare
    Cloudflare (23.227.38.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.community
    Registered
    2026-01-08 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  34. meta-mask-ios.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    meta-mask-ios.pages.dev
    First seen
    2026-10-31 19:46 UTC
    First published
    2026-10-31 20:09 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-10-31 00:00 UTC to 2027-01-16 11:00 UTC
    Logged 2026-10-31 19:44 UTC in Geomys Tuscolo2027h1, entry 423,757,466
    SHA-256 0c29c969c29808b305788dbaf9bc58a8e67eadcfe80cd158ec6d145968d90115
    Public key SHA-256 5c3ffb768ba1b43517d7373743071f1383ccdd2f14644b2715b9845bdfa7a427
    Brand
    MetaMask
    Addresses
    172.66.44.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.55 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cc9
    2606:4700:310c::ac42:2f37
    Cloudflare
    Cloudflare (172.66.44.201, 172.66.47.55): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  35. metamask.community US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    metamask.community
    First seen
    2026-10-31 11:52 UTC
    First published
    2026-10-31 12:01 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 12:09 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-10-31 10:46 UTC to 2027-01-29 11:45 UTC
    Logged 2026-10-31 11:46 UTC in IPng Networks Halloumi2027h1, entry 320,912,750
    SHA-256 856529931f64379aa814da8b433387745d3501e7a4056692044c07947404c6de
    Public key SHA-256 e6192c85af0b58c3a21737f2753b74a9cc56e76047a31a0d39adc730322bdc8e
    Brand
    MetaMask
    Addresses
    23.227.38.71 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2620:127:f00f:b::
    Cloudflare
    Cloudflare (23.227.38.71): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.community
    Registered
    2026-01-08 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  36. metamask.io.in US · AS20473 · The Constant Company, LLC
    ListedVultrListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    metamask.io.in
    First seen
    2026-10-31 11:42 UTC
    First published
    2026-10-31 11:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-31 10:37 UTC to 2027-01-29 10:37 UTC
    Logged 2026-10-31 11:36 UTC in Let's Encrypt Sycamore2027h1, entry 870,553,898
    SHA-256 0e11f4dbb550a1b905c7d67f94996acd680867deecb70d69ce4b5ffb47ec1fb1
    Public key SHA-256 7f731b617f6ba1ad90d9cb0efa2e2dd379ca8acf7c78bed3848d49dbef3f8c1c
    Brand
    MetaMask
    Addresses
    45.77.200.194 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    Vultr
    Vultr (45.77.200.194): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamask.io.in
    Registered
    2023-08-30 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  37. metamask-migration.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    metamask-migration.pages.dev
    First seen
    2026-10-30 23:42 UTC
    First published
    2026-10-30 23:53 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-30 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:58 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-30 16:19 UTC to 2027-01-28 16:19 UTC
    Logged 2026-10-30 17:18 UTC in Google ParcelYard2027h1, entry 525,952,544
    SHA-256 12d8e662a84b67a3419aa8beaec455b2f8ee90a0d1a8f368cb49a6f5be0f058c
    Public key SHA-256 a225a410f6036f7a6833d689108f3f1b6d490cba56e5f44955fba6f4cfeb5631
    Brand
    MetaMask
    Addresses
    172.66.44.190 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cbe
    2606:4700:310c::ac42:2f42
    Cloudflare
    Cloudflare (172.66.44.190, 172.66.47.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  38. zh-metamask.com.cn US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    zh-metamask.com.cn
    First seen
    2026-10-30 20:51 UTC
    First published
    2026-10-30 21:47 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 21:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 19:49 UTC to 2027-01-28 19:49 UTC
    Logged 2026-10-30 20:48 UTC in Let's Encrypt Sycamore2027h1, entry 861,304,811
    SHA-256 047c2a2018305399329c3bc0f648c39c121307a9e38a7cf6f79e3f6e9aea0199
    Public key SHA-256 a6ebcc80a6303f4e45c23f5edc00046e5c9d5eced06018d75ca341a10cd7d1a3
    Brand
    MetaMask
    Addresses
    104.21.95.186 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.146.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:92f9
    2606:4700:3034::6815:5fba
    Cloudflare
    Cloudflare (104.21.95.186, 172.67.146.249): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    zh-metamask.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  39. bot-liqudator-metamask.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    bot-liqudator-metamask.pages.dev
    First seen
    2026-10-30 18:26 UTC
    First published
    2026-10-30 19:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 19:15 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-30 00:00 UTC to 2027-01-14 06:52 UTC
    Logged 2026-10-30 18:22 UTC in IPng Networks Gouda2027h1, entry 272,255,288
    SHA-256 a3ffc001e4cf36ce87861481ce08a7174f992a8b23bc32510c2c17de76d0653b
    Public key SHA-256 4240374f760eb32d30134296779846d25bec224991f7886d1e8fe6996a8d6648
    Brand
    MetaMask
    Addresses
    172.66.44.194 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.62 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cc2
    2606:4700:310c::ac42:2f3e
    Cloudflare
    Cloudflare (172.66.44.194, 172.66.47.62): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  40. meta-mask-extension-ee.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    meta-mask-extension-ee.pages.dev
    First seen
    2026-10-30 12:41 UTC
    First published
    2026-10-30 12:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 11:37 UTC to 2027-01-28 12:34 UTC
    Logged 2026-10-30 12:37 UTC in Google ParcelYard2027h1, entry 522,535,622
    SHA-256 923060717e65b69c4a37cdbeba65c4ef205b7e066fc6e3a85782e02910c26755
    Public key SHA-256 178f5aa64f4b1e69b6bb0e6e6cedf15d172f492a1bd1797b5706c5d666acf692
    Brand
    MetaMask
    Addresses
    172.66.45.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.239 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d11
    2606:4700:310c::ac42:2eef
    Cloudflare
    Cloudflare (172.66.45.17, 172.66.46.239): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  41. www.metamask.cloud US · AS16509 · Amazon.com, Inc.2 addresses
    ListedParking page · AfternicUnder metamask.cloud, listed by MetaMaskMX absentSPF -allDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    www.metamask.cloud
    First seen
    2026-10-30 08:51 UTC
    First published
    2026-10-30 09:42 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:51 UTC
    Listed
    MetaMask, listing metamask.cloud and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-10-30 08:48 UTC to 2027-05-16 08:48 UTC
    Logged 2026-10-30 08:48 UTC in Google Argon2027h1, entry 774,720,910
    SHA-256 a58a93d02a938d94e0093f7f7bfd75a705e465b62dbde20ed2e56391d5dc5870
    Public key SHA-256 dc7db2cb29be42627ee9076245e8355633e16d859aef441dff144f08f9d88f67
    Brand
    MetaMask
    Addresses
    13.248.169.48 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    76.223.54.146 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    Parking page · Afternic
    The registry delegates metamask.cloud to Afternic’s nameservers, which answer for it. Afternic (13.248.169.48, 76.223.54.146): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamask.cloud
    Registered
    2026-10-26 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  42. metamask-email.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by MetaMaskMX absentSPF missingDMARC missingRegistered 19 d ago
    DetailsHide
    Hostname
    metamask-email.com
    First seen
    2026-10-29 17:10 UTC
    First published
    2026-10-29 17:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 17:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-10-29 17:06 UTC to 2027-05-15 17:06 UTC
    Logged 2026-10-29 17:06 UTC in Google Argon2027h1, entry 764,295,522
    SHA-256 3e10812cc45b45e08fb7433eb7ae6da277c4a252fd72e245963156bb1d211bff
    Public key SHA-256 cbd2883422849d9bb2e8f099e8ccd3759a2b692e7e6946c3c9b0ef3e1a1ae6fd
    Brand
    MetaMask
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamask-email.com
    Registered
    2026-10-17 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  43. 8k0c1cqq.metamaskwalletweb3.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under metamaskwalletweb3.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    8k0c1cqq.metamaskwalletweb3.com
    First seen
    2026-10-29 10:35 UTC
    First published
    2026-10-29 10:53 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Listed
    MetaMask, listing metamaskwalletweb3.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 09:36 UTC to 2027-01-27 09:36 UTC
    Logged 2026-10-29 10:35 UTC in Geomys Tuscolo2027h1, entry 393,785,385
    SHA-256 4ed7bc9ad7268cc79f492d16b689a1d03ce8d34eac127941aa5e074571baaf00
    Public key SHA-256 c76f1bce171c02866656e2222b03a9d1605c1ac36cccd993b38dd6e933f84e14
    Brand
    MetaMask
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamaskwalletweb3.com
    Registered
    2026-06-05 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  44. www.metamask.org.es CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    www.metamask.org.es
    First seen
    2026-10-28 19:11 UTC
    First published
    2026-10-28 19:20 UTC
    DNS
    Resolves · checked 2026-11-04 19:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 18:07 UTC to 2027-01-26 18:07 UTC
    Logged 2026-10-28 19:05 UTC in Google PlumbersArms2027h1, entry 494,093,683
    SHA-256 782dbe171f1440812887b864a729e35d7d7c22fbda97cfdad7fbda3156bac54a
    Public key SHA-256 0137628e6ed81bbce71ab1b3a2c2c9015175864914389038560a6b5f5b5ae78f
    Brand
    MetaMask
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    metamask.org.es
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  45. metamask.org.es CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    metamask.org.es
    First seen
    2026-10-28 19:11 UTC
    First published
    2026-10-28 19:20 UTC
    DNS
    Resolves · checked 2026-11-04 19:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 18:07 UTC to 2027-01-26 18:07 UTC
    Logged 2026-10-28 19:05 UTC in Google PlumbersArms2027h1, entry 494,093,683
    SHA-256 782dbe171f1440812887b864a729e35d7d7c22fbda97cfdad7fbda3156bac54a
    Public key SHA-256 0137628e6ed81bbce71ab1b3a2c2c9015175864914389038560a6b5f5b5ae78f
    Brand
    MetaMask
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    metamask.org.es
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  46. metamask.win US · AS14956 · RouterHosting LLC
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    metamask.win
    First seen
    2026-10-28 16:15 UTC
    First published
    2026-10-28 17:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 17:30 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 15:16 UTC to 2027-01-26 15:16 UTC
    Logged 2026-10-28 16:14 UTC in Google PlumbersArms2027h1, entry 491,895,276
    SHA-256 1e18457aa20ea43885a3d31bdca5ef2342a9719f2ae0aceea46ce99bebd842bb
    Public key SHA-256 b20bed0bf89f02640c07b5f73b9cba23d92e02ff520c35e5c08abf9328b51030
    Brand
    MetaMask
    Addresses
    104.194.152.193 · United States · AS14956 ROUTERHOSTING - RouterHosting LLC
    Domain
    metamask.win
    Registered
    2026-10-28 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 22:33 UTC

    Suggest a correction

  47. webdisk.metamaskweb.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under metamaskweb.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    webdisk.metamaskweb.com
    First seen
    2026-10-28 15:00 UTC
    First published
    2026-10-28 15:12 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:21 UTC
    Listed
    MetaMask, listing metamaskweb.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 13:58 UTC to 2027-01-26 13:58 UTC
    Logged 2026-10-28 14:56 UTC in Let's Encrypt Sycamore2027h1, entry 822,141,553
    SHA-256 5ff3410ee98d9134c3f418ec1989894e9d3e4b8ce554da4392477eb447f1b85c
    Public key SHA-256 0f43122657a1ab0c8b99d53e848c5d24fc988e81a766ef9919390b0ca47e2c8a
    Brand
    MetaMask
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamaskweb.com
    Registered
    2025-12-15 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  48. hj1w0e.metamask-ssl.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under metamask-ssl.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    hj1w0e.metamask-ssl.com
    First seen
    2026-10-28 12:31 UTC
    First published
    2026-10-28 13:04 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:20 UTC
    Listed
    MetaMask, listing metamask-ssl.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 11:31 UTC to 2027-01-26 11:31 UTC
    Logged 2026-10-28 12:30 UTC in Google PlumbersArms2027h1, entry 488,930,176
    SHA-256 8b65611eed8a437eb03688282d9096c4c43bc396cdd302e2f84e013a5217c38d
    Public key SHA-256 034bb96a934d98bb870c4cf71010d7feda20727642da442fdfdef3bc3a46e301
    Brand
    MetaMask
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamask-ssl.com
    Registered
    2025-11-20 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  49. cpanel.metamask.eu.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder metamask.eu.com, listed by MetaMask
    DetailsHide
    Hostname
    cpanel.metamask.eu.com
    First seen
    2026-10-28 09:20 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask, listing metamask.eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    104.21.17.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b24c
    2606:4700:3035::6815:11ce
    Cloudflare
    Cloudflare (104.21.17.206, 172.67.178.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  50. cpcalendars.metamask.eu.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder metamask.eu.com, listed by MetaMask
    DetailsHide
    Hostname
    cpcalendars.metamask.eu.com
    First seen
    2026-10-28 09:20 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask, listing metamask.eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    104.21.17.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b24c
    2606:4700:3035::6815:11ce
    Cloudflare
    Cloudflare (104.21.17.206, 172.67.178.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  51. cpcontacts.metamask.eu.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder metamask.eu.com, listed by MetaMask
    DetailsHide
    Hostname
    cpcontacts.metamask.eu.com
    First seen
    2026-10-28 09:20 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask, listing metamask.eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    104.21.17.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b24c
    2606:4700:3035::6815:11ce
    Cloudflare
    Cloudflare (104.21.17.206, 172.67.178.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  52. mail.metamask.eu.com DE · AS24940 · HETZNER-AS Hetzner Online G…
    ListedHetznerUnder metamask.eu.com, listed by MetaMask
    DetailsHide
    Hostname
    mail.metamask.eu.com
    First seen
    2026-10-28 09:20 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask, listing metamask.eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    168.119.38.242 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (168.119.38.242): a cloud provider. It rents servers and addresses to its customers.

    Suggest a correction

  53. webdisk.metamask.eu.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder metamask.eu.com, listed by MetaMask
    DetailsHide
    Hostname
    webdisk.metamask.eu.com
    First seen
    2026-10-28 09:20 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask, listing metamask.eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    104.21.17.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b24c
    2606:4700:3035::6815:11ce
    Cloudflare
    Cloudflare (104.21.17.206, 172.67.178.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  54. webmail.metamask.eu.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder metamask.eu.com, listed by MetaMask
    DetailsHide
    Hostname
    webmail.metamask.eu.com
    First seen
    2026-10-28 09:20 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask, listing metamask.eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    104.21.17.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b24c
    2606:4700:3035::6815:11ce
    Cloudflare
    Cloudflare (104.21.17.206, 172.67.178.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  55. www.metamask.eu.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder metamask.eu.com, listed by MetaMask
    DetailsHide
    Hostname
    www.metamask.eu.com
    First seen
    2026-10-28 09:20 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask, listing metamask.eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    104.21.17.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b24c
    2606:4700:3035::6815:11ce
    Cloudflare
    Cloudflare (104.21.17.206, 172.67.178.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  56. www.supportmetamask.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.supportmetamask.online
    First seen
    2026-10-28 06:12 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 05:07 UTC to 2027-01-26 05:07 UTC
    Logged 2026-10-28 06:05 UTC in Google PlumbersArms2027h1, entry 484,289,071
    SHA-256 91a74a71180f9be0b86cc4d7cfd60f623fe0a11384fa5c719a66e84b36ccdbe9
    Public key SHA-256 f5d43cd26bb377882218d769ce7159f474be34e3719ab817f9302a457186bd75
    Brand
    MetaMask
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    supportmetamask.online
    Registered
    2026-05-15 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  57. supportmetamask.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    supportmetamask.online
    First seen
    2026-10-28 06:12 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-28 05:07 UTC to 2027-01-26 05:07 UTC
    Logged 2026-10-28 06:05 UTC in Google PlumbersArms2027h1, entry 484,289,071
    SHA-256 91a74a71180f9be0b86cc4d7cfd60f623fe0a11384fa5c719a66e84b36ccdbe9
    Public key SHA-256 f5d43cd26bb377882218d769ce7159f474be34e3719ab817f9302a457186bd75
    Brand
    MetaMask
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    supportmetamask.online
    Registered
    2026-05-15 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  58. www.metamask.mobi US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder metamask.mobi, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 13 d ago
    DetailsHide
    Hostname
    www.metamask.mobi
    First seen
    2026-10-28 05:00 UTC
    First published
    2026-10-28 05:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Listed
    MetaMask, listing metamask.mobi and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 03:58 UTC to 2027-01-26 03:58 UTC
    Logged 2026-10-28 04:56 UTC in Google ParcelYard2027h1, entry 482,887,861
    SHA-256 025d33c7684ae1fb3c34c298d0524e8de41d28e2af467b8e3cfd838a472c636b
    Public key SHA-256 164301257621cf2e9ccf1769d0816ee6ab367f43803ea91925c3a246cf1c1386
    Brand
    MetaMask
    Addresses
    104.21.73.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.151.122 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:977a
    2606:4700:3032::6815:49f7
    Cloudflare
    Cloudflare (104.21.73.247, 172.67.151.122): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.mobi
    Registered
    2026-10-23 · NameMart Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:55 UTC

    Suggest a correction

  59. metamask.wallet-login.com FR · AS16276 · OVH OVH SAS
    ListedOVHUnder wallet-login.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 12 d ago
    DetailsHide
    Hostname
    metamask.wallet-login.com
    First seen
    2026-10-28 04:36 UTC
    First published
    2026-10-28 05:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask, listing wallet-login.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-28 03:36 UTC to 2027-01-26 03:36 UTC
    Logged 2026-10-28 04:34 UTC in Google ParcelYard2027h1, entry 482,686,076
    SHA-256 7a9287505ddc69d80ce29e8259a44aaa6224eb1c09f62e348652f2eac2f13f03
    Public key SHA-256 9335e5124720a16537011d4080a12f2257df8ca7f54da58fad73c0d0f8c57ddc
    Brand
    MetaMask
    Addresses
    15.235.92.35 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (15.235.92.35): a cloud provider. It rents servers and addresses to its customers.
    Domain
    wallet-login.com
    Registered
    2026-10-24 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:27 UTC

    Suggest a correction

  60. metamask.mobi
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 13 d ago
    DetailsHide
    Hostname
    metamask.mobi
    First seen
    2026-10-28 04:31 UTC
    First published
    2026-10-28 05:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 03:29 UTC to 2027-01-26 03:29 UTC
    Logged 2026-10-28 04:27 UTC in Google ParcelYard2027h1, entry 482,617,465
    SHA-256 9f7b8be2031f33cf5513d52995ea87b2dc01da8695ad2f788cafa83000340da0
    Public key SHA-256 24942832e7c95f47f99bf9ad0798a15319d3a476ba902ac61c1ffaa195e2ff18
    Brand
    MetaMask
    Domain
    metamask.mobi
    Registered
    2026-10-23 · NameMart Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:55 UTC

    Suggest a correction

  61. metamask.today US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by MetaMaskMX presentSPF ~allDMARC policy noneRegistered 31 d ago
    DetailsHide
    Hostname
    metamask.today
    First seen
    2026-10-28 03:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1 · precertificate
    Valid 2026-10-28 03:05 UTC to 2027-05-14 03:05 UTC
    Logged 2026-10-28 03:05 UTC in Google Argon2027h1, entry 736,856,004
    SHA-256 a517b34114edf9a67b69ef8fcc5e0aca48ca25e9b55e8c5c4d45bbde3658d797
    Public key SHA-256 bbf07300b9b98a3786db6a7c64325f8020512f3a32a9970b389afeb9a0ae8d21
    Brand
    MetaMask
    Addresses
    13.248.213.45 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.67.189 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.213.45, 76.223.67.189): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamask.today
    Registered
    2026-10-05 · Wild West Domains, LLC
    MX
    Receives mail at mx.elasticemail.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 09:50 UTC

    Suggest a correction

  62. metamask.pw
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    metamask.pw
    First seen
    2026-10-28 03:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-28 · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 02:02 UTC to 2027-01-26 02:02 UTC
    Logged 2026-10-28 03:00 UTC in Let's Encrypt Sycamore2027h1, entry 813,180,239
    SHA-256 5747774c2bad258ac9982162ff6cc7f31923c7a2d5dc547186e5f20aac0005bc
    Public key SHA-256 07f2057005ffa703d1b97d8709575b7c14a1ac261524dd75ee2942002b8b6089
    Brand
    MetaMask
    Domain
    metamask.pw
    Registered
    2026-06-08 · Hefei Juming Network Technology Co., Ltd
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  63. pc-metamask.com.cn US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    pc-metamask.com.cn
    First seen
    2026-10-27 22:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-27 22:08 UTC to 2027-01-22 14:23 UTC
    Logged 2026-10-27 22:18 UTC in DigiCert Wyvern2027h1, entry 325,280,142
    SHA-256 ca1248e842adaaa35835cae21217d527acb5b5b7acf78c73d84233dd035b1322
    Public key SHA-256 662617a778eb53ad866553b41f954312693de2cb928f939769f515835402a515
    Brand
    MetaMask
    Addresses
    104.21.42.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.163.134 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:a386
    2606:4700:3033::6815:2a9f
    Cloudflare
    Cloudflare (104.21.42.159, 172.67.163.134): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pc-metamask.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

  64. signup-meta-mask-io.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    signup-meta-mask-io.pages.dev
    First seen
    2026-10-27 15:01 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 14:00 UTC to 2027-01-25 14:00 UTC
    Logged 2026-10-27 14:59 UTC in Google PlumbersArms2027h1, entry 473,711,267
    SHA-256 53d6de43a38f4d371c2a614a28f7f5d2e6f5407080bf4a316d694a87bb30ec45
    Brand
    MetaMask
    Addresses
    172.66.44.93 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.163 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c5d
    2606:4700:310c::ac42:2fa3
    Cloudflare
    Cloudflare (172.66.44.93, 172.66.47.163): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  65. metamask.si US · AS16509 · Amazon.com, Inc.
    ListedParking page · Dynadot parkingListed by MetaMaskMX absentSPF missingDMARC missingRegistered 44 d ago
    DetailsHide
    Hostname
    metamask.si
    First seen
    2026-10-27 11:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 470,301,758
    SHA-256 5cdb3f9d6ee985ac5910115138d8b6e77f37611220813e4a6bcf8b7a25d7ebd5
    Brand
    MetaMask
    Addresses
    54.215.31.113 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Dynadot parking (parking page)
    Parking page · Dynadot parking
    Dynadot parking (54.215.31.113): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamask.si
    Registered
    2026-09-22 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  66. cn-metamask.com.cn US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    cn-metamask.com.cn
    First seen
    2026-10-27 11:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 321,457,314
    SHA-256 5c3ab9bf8d234bfe273a12b94e76ce6f0859857c42371a313354b7fa16a8a78f
    Brand
    MetaMask
    Addresses
    104.21.67.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.212.46 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:432c
    2606:4700:3037::ac43:d42e
    Cloudflare
    Cloudflare (104.21.67.44, 172.67.212.46): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    cn-metamask.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  67. metamask88.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 22 mo ago
    DetailsHide
    Hostname
    metamask88.com
    First seen
    2026-10-27 06:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 467,096,126
    SHA-256 4cc834911787b9be356c2a9963cd2635bd1be1b572484274435dac550a69d25e
    PhishDestroy
    Brand
    MetaMask
    Addresses
    104.21.70.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.141.22 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:8d16
    2606:4700:3035::6815:46fb
    Cloudflare
    Cloudflare (104.21.70.251, 172.67.141.22): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask88.com
    Registered
    2025-01-22 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  68. doc-meta-mask.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    doc-meta-mask.pages.dev
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    172.66.44.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c8a
    2606:4700:310c::ac42:2f76
    Cloudflare
    Cloudflare (172.66.44.138, 172.66.47.118): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  69. metamask-airdrop.icu US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    metamask-airdrop.icu
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-29 · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    104.21.86.67 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:5643
    2606:4700:3033::ac43:d85a
    Cloudflare
    Cloudflare (104.21.86.67, 172.67.216.90): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask-airdrop.icu
    Registered
    2026-10-26 · Eranet International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

  70. metamask.casino US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    metamask.casino
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-30 07:18 UTC to 2027-01-25 20:10 UTC
    Logged 2026-10-30 07:28 UTC in Let's Encrypt Willow2027h1, entry 845,739,400
    SHA-256 45ccd25967617183b72594981f1ebd13b5369c14082086816dae1d99473b3b2e
    Public key SHA-256 3628a038f0e5d24cef563a12e15abdf90ebc0b19e131f31c8d988e38d80814ac
    Brand
    MetaMask
    Addresses
    104.21.60.242 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.202.199 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:cac7
    2606:4700:3033::6815:3cf2
    Cloudflare
    Cloudflare (104.21.60.242, 172.67.202.199): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamask.casino
    Registered
    2026-08-28 · Devexpanse Ltd d/b/a Regery.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  71. metamask.cloud DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · AfternicListed by MetaMaskMX absentSPF -allDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    metamask.cloud
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    185.53.179.149 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · Afternic
    The registry delegates metamask.cloud to Afternic’s nameservers, which answer for it. Afternic: a parking service. It answers for names that are typically for sale or unused. ParkingCrew (Team Internet) (185.53.179.149): a parking service. It answers for names that are typically for sale or unused.
    Domain
    metamask.cloud
    Registered
    2026-10-26 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  72. metamask.eu.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    metamask.eu.com
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:17 UTC to 2027-01-26 08:17 UTC
    Logged 2026-10-28 09:15 UTC in DigiCert Wyvern2027h1, entry 332,020,852
    SHA-256 6228d37e79ae2c624fde08ef38bd0ec66ede2d6a2b87e85dc6aabb0e79f9b372
    Public key SHA-256 75c93a99075329c7ccaa74077aabcaf563412ccd286ee63fbe5f355d238ee9ce
    Brand
    MetaMask
    Addresses
    104.21.17.206 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.76 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:b24c
    2606:4700:3035::6815:11ce
    Cloudflare
    Cloudflare (104.21.17.206, 172.67.178.76): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  73. metamaskairdrop.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    metamaskairdrop.pages.dev
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    172.66.44.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.12 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cf4
    2606:4700:310c::ac42:2f0c
    Cloudflare
    Cloudflare (172.66.44.244, 172.66.47.12): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  74. metamaskpro.cc US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    metamaskpro.cc
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    104.21.0.93 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.204 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:5d
    2606:4700:3031::ac43:96cc
    Cloudflare
    Cloudflare (104.21.0.93, 172.67.150.204): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamaskpro.cc
    Registered
    2026-05-02 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  75. metamaskpro.vip US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    metamaskpro.vip
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Latest DNS check
    Brand
    MetaMask
    Addresses
    104.21.89.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.155.126 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:9b7e
    2606:4700:3035::6815:5909
    Cloudflare
    Cloudflare (104.21.89.9, 172.67.155.126): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    metamaskpro.vip
    Registered
    2026-05-02 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

  76. metamaskverify.info US · AS14956 · RouterHosting LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    metamaskverify.info
    First seen
    2026-10-26 17:31 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 144.172.112.30.
    1. Phishing-host list fetched with the address
    2. Resolved to 144.172.112.30
    3. Latest DNS check
    Certificate
    Logged in Google PlumbersArms2027h1, entry 458,761,749
    SHA-256 92af2aa803cb23277ba08358cbc6dc73bf940ae4d580f7006fc4da7d3bc49fcf
    Brand
    MetaMask
    Addresses
    144.172.112.30 · United States · AS14956 ROUTERHOSTING - RouterHosting LLC
    Domain
    metamaskverify.info
    Registered
    2025-11-06 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:22 UTC

    Suggest a correction

  77. xn--metamask-nh9mg735c.com CN · AS45102 · Alibaba (US) Technology Co.…
    ListedPhishing hostAlibaba CloudListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 23 d ago
    DetailsHide
    Hostname
    xn--metamask-nh9mg735c.com
    First seen
    2026-10-26 11:52 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 8.222.166.183.
    1. Phishing-host list fetched with the address
    2. Resolved to 8.222.166.183
    3. Latest DNS check
    Certificate
    Issued by LiteSSL RSA CA 2025 · precertificate
    Valid 2026-10-28 01:00 UTC to 2027-01-26 00:59 UTC
    Logged 2026-10-28 02:55 UTC in Google Xenon2027h1, entry 604,032,075
    SHA-256 585a77388f9059c17a90d77afd75fab7d1217ead370238b108ae392662e1f8c9
    Public key SHA-256 98029e323c7d889fe356bcfe7a5a213ebd037d737887e1616785a345c53c4329
    Certificate
    Logged in Google Xenon2027h1, entry 579,060,330
    SHA-256 2aec1edfeb77a1993606c69cc97c54f487d25ac79f5bd4c829478d5f8b488a41
    Brand
    MetaMask
    Addresses
    8.222.166.183 · China · AS45102 ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. · Alibaba Cloud (cloud provider)
    Alibaba Cloud
    Alibaba Cloud (8.222.166.183): a cloud provider. It rents servers and addresses to its customers.
    Domain
    xn--metamask-nh9mg735c.com
    Registered
    2026-10-13 · West263 International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

  78. metamask.ooo CN · AS45102 · Alibaba (US) Technology Co.…
    Phishing hostAlibaba CloudAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    metamask.ooo
    First seen
    2026-10-26 11:52 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 8.222.166.183.
    1. Phishing-host list fetched with the address
    2. Resolved to 8.222.166.183
    3. Latest DNS check
    Certificate
    Logged in Google Xenon2027h1, entry 579,060,330
    SHA-256 2aec1edfeb77a1993606c69cc97c54f487d25ac79f5bd4c829478d5f8b488a41
    Brand
    MetaMask
    Addresses
    8.222.166.183 · China · AS45102 ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. · Alibaba Cloud (cloud provider)
    Alibaba Cloud
    Alibaba Cloud (8.222.166.183): a cloud provider. It rents servers and addresses to its customers.
    Domain
    metamask.ooo
    Registered
    2026-09-01 · West263 International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches MetaMask when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →