metamask[.]hk[.]cn

Analysis of metamask.hk.cn, observed on July 22 2026, indicates a high‑risk brand‑impersonation campaign that aligns with a crypto‑drainer profile. The domain was registered on March 29 2026 through Shenzhen Wanweiwang Information Technology Co., Ltd and resolves to IP 43.162.105.200, which is allocated to Tencent Cloud Computing (Beijing) Co., Ltd in the United States. The web server identifies as Nginx and enforces HTTP Strict Transport Security, while the TLS certificate is issued by Let’s Encrypt under the YR1 automation profile, confirming a valid but easily obtainable SSL chain. An HTTP request returns a 200 status code, demonstrating that the site is actively serving content.

The page title captured in the crawl – “MetaMask下载 | 小礼包星含方下载 - 全网1千万用户首选加密” – contains the MetaMask brand and Chinese keywords that suggest a download offering, reinforcing the impersonation intent. The domain appears on three public security blocklists and is specifically blocked by PhishDestroy, MetaMask’s own threat‑intel feed, and SEAL, indicating that multiple industry‑wide sources have already flagged the site as malicious. VirusTotal analysis shows that 15 of 91 scanning engines label the domain as malicious, providing additional independent confirmation of its threat nature. Infrastructure indicators such as the use of a reputable cloud provider combined with a free SSL certificate are typical of fast‑deployment fraud operations.

Defenders should add metamask.hk.cn to URL filtering rules, block the resolved IP address 43.162.105.200 at the network perimeter, and monitor for any outbound connections to that host. Email gateways should be configured to quarantine messages that reference the domain or its associated download‑related keywords.