zh-metamask[.]com

This domain, zh-metamask.com, is flagged as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the infrastructure was designed to deceive users into disclosing wallet credentials or interacting with malicious smart contracts, likely facilitating unauthorized fund transfers. No direct evidence of a crypto drainer kit was observed, but the domain aligns with known credential theft tactics used in cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through West263 International Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 45.207.200.158, hosted under AS8796 (FASTNET DATA INC) in the United States. The domain is currently flagged by 21 out of 95 security vendors on VirusTotal, with two independent blocklists (PhishDestroy and Enkrypt) actively blocking it. The SSL certificate was issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains due to its low-cost, automated issuance process. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though this may reflect a lag in reporting rather than absence of malicious activity. The domain has since been taken offline, reducing immediate risk to end users. However, residual threats persist, including potential reuse of the IP address or registrar for future malicious campaigns. Users who interacted with the domain prior to its takedown may remain at risk of credential compromise or wallet exploitation. Recommended actions include revoking any active sessions tied to MetaMask or similar services, rotating passwords, and monitoring wallet transactions for unauthorized activity. Organizations should update blocklists to include the domain and IP address, while security teams may investigate related infrastructure for signs of broader campaign activity.