{"report_id":"b427833d-7390-41b5-8682-5beb5f007530","version":0,"status":"done","tags":[],"date":"2026-06-08T13:24:05Z","url":{"schema":"http","addr":"metamasks.com.cn","fqdn":"metamasks.com.cn","domain":"metamasks.com.cn","tld":"com.cn"},"ip":{"addr":"111.68.12.182","port":0,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"metamasks.com.cn/","fqdn":"metamasks.com.cn","domain":"metamasks.com.cn","tld":"com.cn"},"title":"MetaMask官网 - 领先的加密钱包平台 | 通往区块链Web3世界的门户","dom":{"size":56008,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0cc2894db7398fb2a0188018d2ac3063","sha1":"6e9cfdcc61375dcf42bd21c4b2530af64081c463","sha256":"e8e73e6ba311224105e65897cb44202eab2aa38506404a75fbbd71ec31469de0","sha512":"eca2a026ca2b92e71f7aa7b0dba9cba2b339e249b46f973a1508c6214bd5a4637328924ac91b84dd4ea2ad5198dbb97b1394167bd6f9309c8c516de48b1af527","ssdeep":"384:xu1+/nMyliyGdSK3WbrpF5t9czC20gu0zFLPqtl:ywia3RAzC20guy7qz","tlshash":"b743742a21f320665463e1a56bfb17592b60e007c90bce593fed07c88fc6e95ac9374d","dom_hash":"domhash5b16a3551413127eeafac47116db20bb","first_seen":"2026-06-08T13:12:53.533714Z","last_seen":"2026-06-08T13:24:07.041087Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"metamasks.com.cn","fqdn":"metamasks.com.cn","domain":"metamasks.com.cn","tld":"com.cn"},"ip":{"addr":"111.68.12.182","port":0,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-13T13:24:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"metamasks.com.cn","ip":{"addr":"111.68.12.182","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-05-13","domain_rank":0,"first_seen":"2026-06-08T13:12:47.219874Z","last_seen":"2026-06-08T13:12:47.219874Z","alert_count":6,"request_count":3,"received_data":91574,"sent_data":1505,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"metamasks.com.cn/","fqdn":"metamasks.com.cn","domain":"metamasks.com.cn","tld":"com.cn"},"ip":{"addr":"111.68.12.182","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"06d12f2edcc8b9174cbe9337988ee9bc","sha1":"d150b7f4a40c917e7f2edfb593b5be06cc69c830","sha256":"2b8061facc7e3564da23d8ef8472e7db49de5f1e66c101a0ece6dd0ab452dba4","sha512":"3240886fb91b30b0f52db289421cbee7d3c925363e8dbd5770a7188ed392c03fb40b8c8029fc71ce9687b4fc09a7c8460e8f57236547af663682b5e00a824036","ssdeep":"96:uDQPf8nOANyHxkA1emiURCatCpAv6PxR2tFMV3Rq2q:uDQPf8nOANwxxemijatCXPxR2TC4l","tlshash":"ecc1641b21b71039c577626f479b93443630200b7542cd5e3f6e8b481f92a71aef2be5","size":5811,"data":"","first_seen":"2026-06-08T13:12:53.545617Z","last_seen":"2026-06-08T13:24:07.044008Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"metamasks.com.cn/","fqdn":"metamasks.com.cn","domain":"metamasks.com.cn","tld":"com.cn"},"ip":{"addr":"111.68.12.182","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:23:41.844Z","timestamp":1780925021844,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamasks.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 14:37:35 GMT","end":"Tue, 11 Aug 2026 14:37:34 GMT"},"fingerprint":{"sha1":"DF:4F:8C:86:AB:DC:B5:68:13:04:EF:B0:65:B2:45:86:E4:02:32:8F","sha256":"F9:05:9C:7F:8F:28:66:32:B7:90:50:5C:F8:CC:EA:FF:5F:26:D4:3C:A9:C6:EF:9C:67:01:93:98:CE:4B:5A:4A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: metamasks.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 29 May 2026 07:54:45 GMT\r\netag: \"dbcd-652f0287b4672-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 11619\r\ncontent-type: text/html\r\ndate: Mon, 08 Jun 2026 13:23:42 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":56269,"size_decoded":11903,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"5b39cf2c03dfe5585abf551c103eb339","sha1":"0de7632bb6353479a827f61e8d2aa52700e19d7e","sha256":"2e6fcfb2e91c8476a178124705cc5820a2b934fb87e92ce05c9b99a9eee5c856","sha512":"a82ebfc1818a93ce4e5a7a4bfb145cdf56d6a4172a570e82626b5a89cc75d7df69c7a3ac9432520b1b2c7ba8b2e58d3bfba8897e7b4607417c8c0c16823a87f7","ssdeep":"384:qu1+/nMyliyGdSK3WbrpF5V9cfC20guEzFLPqtZ:7wia3RofC20gui7qT","tlshash":"eb43732a21f320665463e1a56bbb17593b70e007c90bce593fed07c88fc6e95ac93749","first_seen":"2026-06-08T13:12:53.537198Z","last_seen":"2026-06-08T13:24:07.041786Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1224,"timings":{"blocked":-1,"dns":358,"connect":172,"send":0,"wait":344,"receive":0,"ssl":350},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamasks.com.cn/metalogo.png","fqdn":"metamasks.com.cn","domain":"metamasks.com.cn","tld":"com.cn"},"ip":{"addr":"111.68.12.182","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamasks.com.cn/","date":"2026-06-08T13:23:43.272Z","timestamp":1780925023272,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamasks.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 14:37:35 GMT","end":"Tue, 11 Aug 2026 14:37:34 GMT"},"fingerprint":{"sha1":"DF:4F:8C:86:AB:DC:B5:68:13:04:EF:B0:65:B2:45:86:E4:02:32:8F","sha256":"F9:05:9C:7F:8F:28:66:32:B7:90:50:5C:F8:CC:EA:FF:5F:26:D4:3C:A9:C6:EF:9C:67:01:93:98:CE:4B:5A:4A"}}},"request":{"raw":"GET /metalogo.png HTTP/1.1\r\nHost: metamasks.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://metamasks.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Wed, 13 May 2026 15:29:10 GMT\r\netag: \"7609-651b4a42f5126\"\r\naccept-ranges: bytes\r\ncontent-length: 30217\r\ncontent-type: image/png\r\ndate: Mon, 08 Jun 2026 13:23:43 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":30217,"size_decoded":30449,"mime_type":"image/png","magic":"PNG image data, 338 x 324, 8-bit/color RGBA, non-interlaced","md5":"5c391877ee2b17f1c3316d02705cac2a","sha1":"4b721f53784c41a54c5f386225863d7e49edd92a","sha256":"3b5fa4b5958f577543ca53c2cf489547cce71ad423b3a7b589898e6d6000720d","sha512":"ee4c6a0f6d25624bc27b53875ddf453b13d61c04f629a8c100074586e675f05181496870bd6720a81790dd5fad00b11105146e33e62a00044a6dbfb25d288fb3","ssdeep":"768:Oy5mHvrOsebK+3EA1DX8EH1cM2h9bP7pJK7J8x:VAPrmbK+3EA58e1Kh9Zz","tlshash":"95d2f20cfd56b3ab272f8eab5d3e4805c86bd58431681f1c75b9110efa0ab9f394494e","first_seen":"2026-06-08T13:12:53.53996Z","last_seen":"2026-06-08T13:24:07.042608Z","times_seen":2,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metamasks.com.cn/favicon.ico","fqdn":"metamasks.com.cn","domain":"metamasks.com.cn","tld":"com.cn"},"ip":{"addr":"111.68.12.182","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metamasks.com.cn/","date":"2026-06-08T13:23:43.439Z","timestamp":1780925023439,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.metamasks.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 14:37:35 GMT","end":"Tue, 11 Aug 2026 14:37:34 GMT"},"fingerprint":{"sha1":"DF:4F:8C:86:AB:DC:B5:68:13:04:EF:B0:65:B2:45:86:E4:02:32:8F","sha256":"F9:05:9C:7F:8F:28:66:32:B7:90:50:5C:F8:CC:EA:FF:5F:26:D4:3C:A9:C6:EF:9C:67:01:93:98:CE:4B:5A:4A"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: metamasks.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://metamasks.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Wed, 13 May 2026 15:30:03 GMT\r\netag: \"10be-651b4a750c245-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1735\r\ncontent-type: image/x-icon\r\ndate: Mon, 08 Jun 2026 13:23:43 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4286,"size_decoded":2021,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"06f0d6470ffea60a550e7ae1053ba9e7","sha1":"602efd8f38b35b122a8d6451d57fa5ff46271489","sha256":"f540f037dfd3145adb8f6f49b998d4c5eb8de5770b989cebf1703f0d18fa55b9","sha512":"80af155648447d336a23b1b46d7bdb8e5e574e9cfe3b2eca4fd2091ebc8be8ada50b9c22bd9b0d6f5a4a4f6d5ceeee65f8aa3a8531ff71241c8c54ea7a2f62ca","ssdeep":"48:n6jdR0NIX8CJe84Icx2VXtxl6vgZESD2IKTZ99ceMG2X6UBST3Vyx8i:KdGNIbJePx2J/D2nTZ9BMF6UBC3","tlshash":"4691c82f64620068db5d0c3584192668043bed157b6780a3d488ff6fe6f059d13df81f","first_seen":"2026-05-30T15:29:19.330053Z","last_seen":"2026-06-08T13:24:07.043472Z","times_seen":3,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"metamasks.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}