quanyixin[.]metamask-ldexweb3[.]com

This domain was registered on September 16, 2025 through Gname.com Pte. Ltd. The fully qualified name quanyixin.metamask-ldexweb3.com resolves to the IPv4 address 45.202.214.62, which is advertised as belonging to CNSERVERS LLC in Hong Kong under AS40065. The authoritative nameservers b3.share-dns.net and a3.share-dns.com are typical of shared hosting services. No TLS certificate is presented; HTTP connections are therefore unencrypted. A scan on VirusTotal returned 16 positive detections out of 95 engines, confirming that multiple security vendors consider the host malicious. The domain appears on at least one public blocklist and is actively listed by PhishDestroy, indicating that threat‑intel feeds have already flagged it.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low reputation. The page title returned from the HTTP response is the Chinese word “登录”, which translates to “login”, a common indicator of credential‑collection pages. The report classifies the activity as a crypto‑related brand impersonation targeting MetaMask, and the domain is explicitly listed as impersonating MetaMask. The current operational status is offline, suggesting the site has been taken down or is temporarily inaccessible, but the underlying infrastructure remains observable. Defenders should treat the host as hostile.

Immediate steps include adding the domain and its IP address to network blocklists, updating URL filtering policies, and monitoring for any resurrection of the site under the same IP or sibling domains. Because the nameservers are shared, other domains using the same infrastructure may also be malicious and should be reviewed. Continuous re‑scanning of the IP range is advised, as the absence of TLS and the low trust score indicate a high likelihood of credential harvesting. Until the domain is confirmed permanently retired, security teams should maintain vigilance for any re‑appearance in traffic logs.