metamasks[.]com[.]cn

Analysis of the domain metamasks.com.cn, observed on July 23, 2026, indicates a high‑risk brand‑impersonation campaign targeting MetaMask users. The site was registered on June 08, 2026 through 北京新网数码信息技术有限公司 and resolves to the IP address 111.68.12.182, which is geolocated to Hong Kong and associated with the Netsec hosting provider. The server presents an Apache HTTP Server banner and returns HTTP status code 200, suggesting the web service is actively delivering content. The TLS certificate is issued by Let’s Encrypt under the R12 automation, confirming the use of a freely‑issued certificate rather than a brand‑validated one. The page title captured from the site reads "MetaMask官网 - é¢†å ˆçš„åŠ å¯†é’±åŒ å¹³å° | 通往区块链Web3世界的门æˆ", which is a garbled Unicode string but contains the word “MetaMask,” reinforcing the impersonation intent.

Threat intelligence sources corroborate the malicious nature of the domain: it appears in four AlienVault OTX pulses and is listed on three external security blocklists. Independent scanning services have flagged the domain, with 21 of 91 security vendors on VirusTotal marking it as malicious. The Gridinsoft trust score is 0 out of 100, indicating a lack of trust. Defensive feeds such as PhishDestroy, MetaMask’s own blocklist, and SEAL have already blocked the domain, reflecting consensus among security vendors. While the exact phishing kit or credential‑capture mechanism has not been disclosed, the combination of brand‑impersonation indicators, active hosting, and multiple vendor detections confirms a credible threat.

Defenders should continue to block metamasks.com.cn at network perimeters, update endpoint protection signatures, and monitor for any traffic to the associated IP address. Given the recent registration date, the infrastructure may evolve; continuous observation of DNS changes, certificate renewals, and additional host additions is advised.