zh-metamask[.]com[.]cn

This domain, zh-metamask.com.cn, is flagged as a high-risk crypto drainer, active as of July 19, 2026. Infrastructure analysis reveals it resolves to IP address 172.67.146.249 and was registered on June 28, 2026, through Web Commerce Communications Limited. Of 95 security vendors on VirusTotal, 11 detect this domain as malicious, confirming its association with cryptocurrency theft operations. The domain name incorporates 'metamask,' a well-known cryptocurrency wallet, suggesting an intent to deceive users into interacting with fraudulent wallet interfaces or transaction prompts. No further details about the specific attack vectors, such as JavaScript payloads or wallet-draining scripts, are currently available. Defenders should treat this domain as hostile and prioritize blocking it at DNS, proxy, and endpoint layers. Network logs should be reviewed for any connections to 172.67.146.249 or subdomains of zh-metamask.com.cn, particularly in environments where cryptocurrency transactions occur. Given the domain's recent registration and active status, monitoring for newly created subdomains or IP changes is recommended. No legitimate association with the referenced wallet service is confirmed.