h5[.]nmetamasks[.]top

This domain h5.nmetamasks.top was created on July 23, 2026 and is registered through NameSilo, LLC. Current DNS queries resolve the name to the IPv4 address 103.30.76.121, and the authoritative name servers are listed as hasslo.ns.cloudflare.com and sloan.ns.cloudflare.com, confirming that the domain leverages Cloudflare’s DNS service. The domain is flagged on two public security blocklists and has been explicitly listed by the PhishDestroy and OpenPhish feeds, indicating that external intelligence sources consider it a malicious resource. VirusTotal analysis shows that 14 of 91 scanned security vendors raise a detection for the domain, providing moderate consensus among automated scanners that the site exhibits suspicious behavior. The supplied threat classification identifies the activity as a crypto drainer, implying that the site is designed to capture cryptocurrency credentials or redirect transactions to attacker‑controlled wallets.

No publicly available information about SSL certificate details, HTTP response codes, page title, or content rendering has been observed, leaving those aspects of the infrastructure unverified at this stage. The risk level assigned to the domain is high, and its status remains active, meaning that the infrastructure is still reachable. Defenders should proactively block outbound connections to the IP address 103.30.76.121 and enforce URL filtering rules that deny access to h5.nmetamasks.top.

Endpoint detection and response solutions ought to incorporate the domain into their malicious URL watchlists, and any attempted connections should be captured for forensic review. Ongoing monitoring of DNS record changes, blocklist inclusion, and additional VirusTotal submissions is advised to capture any evolution in the threat landscape. Organizations that handle cryptocurrency assets should treat any interaction with this domain as a potential compromise and initiate incident response procedures if exposure is suspected.