clashhx[.]com[.]cn

The domain clashhx.com.cn has been identified as a high-risk phishing site. It is currently active and poses a specific threat of generic phishing by impersonating a legitimate download page for ClashX, a popular open-source application. This impersonation can lead users to inadvertently download malicious software, compromising their security and privacy.

Analysis indicates that clashhx.com.cn is flagged by 13 of 95 security vendors on VirusTotal, which suggests a significant level of suspicion and potential threat. The domain is registered through Web Commerce Communications Limited and resolves to the IP address 172.67.217.78. It appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services / WE1, which may give a false sense of security to users. The page title, 'ClashX for Mac 2026｜GitHub 开源・安全可审计｜Clash,' further mimics the appearance of a legitimate source, enhancing the phishing scheme's credibility.

The current status of clashhx.com.cn remains active, indicating ongoing malicious activity. Users are advised to exercise extreme caution and avoid interacting with this domain. Security professionals should consider adding this domain to their blocklists and monitoring for any related infrastructure. Given the high risk level and the specific threat of impersonation, immediate action is recommended to mitigate potential damage.