metamask-china[.]com

Analysis indicates a high-risk brand impersonation domain targeting MetaMask users through counterfeit wallet download content and localized Chinese-language branding. The infrastructure is crafted to visually and semantically resemble legitimate wallet onboarding and extension distribution pages, increasing the probability of social engineering success and credential or seed phrase harvesting.

Technical intelligence confirms multiple independent risk signals across reputation, infrastructure, and hosting metadata. VirusTotal reports 13/95 security vendors flagging the domain as malicious or phishing-related. The domain is registered via DYNADOT LLC and resolves to IP address 111.68.12.183 located in Hong Kong under AS45753 Netsec Limited. The domain creation date is December 18, 2025, indicating a recently established asset consistent with disposable phishing infrastructure. The site uses a Let's Encrypt R12 SSL certificate, which provides transport encryption but does not validate organizational identity, a common trait in impersonation campaigns. The domain is present on three security blocklists: PhishDestroy, MetaMask, and SEAL, confirming cross-vendor consensus of malicious behavior. The system is currently active and reachable. The observed page title 'MetaMask - 小狐狸钱包下载 | 以太坊' indicates deliberate impersonation of a well-known cryptocurrency wallet brand and inclusion of Chinese-language targeting to attract regional users.

Immediate mitigation actions are required due to the high likelihood of phishing intent. End users should be instructed not to input wallet credentials, recovery phrases, or private keys, and to avoid downloading any software or browser extensions from the domain. Network defenders should enforce domain blocking at DNS, web gateway, and endpoint protection layers, and add the IP 111.68.12.183 and related ASN 45753 traffic patterns to monitoring rules. Security teams should integrate the domain into threat intelligence feeds and apply heuristic detection for MetaMask impersonation keywords, including multilingual variants. Browser isolation or sandboxing should be applied for any attempted access. Additionally, organizations should conduct targeted phishing awareness training focusing on cryptocurrency wallet impersonation tactics and ensure updated filtering rules are deployed across email and web security stacks.