Is metahuay.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

A localized Chinese landing page for a digital entertainment title, the site presents Mahjong Soul as a free-to-download online riichi-mahjong game with character collection, competitive play, PC/mobile/Steam access, and monetization through in-app purchases and gacha-style draws.

Scam/Impersonation Risk

Confirmed external threat indicators create a critical interaction risk despite the page’s professional gaming presentation and the absence of an observed login form, hidden form, wallet connection, or explicit brand-impersonation marker. The site promotes downloads and account registration, while observed network activity included non-whitelisted external requests and posts; this creates additional uncertainty around the download and registration pathways. The domain is blacklisted by external sources, with multiple malicious detections including coverage from Fortinet and Sophos. The historical record also conflicts with the current registration record: archival captures predate the recorded 2026 creation date, so domain provenance cannot be treated as straightforward. No conflicting legal-entity names were observed, but the external threat evidence is sufficient to require a clearly defensive posture. Evidence:

• The homepage presents Mahjong Soul gameplay, character acquisition, gacha probabilities, registration, and PC/mobile/Steam download routes.
• External reputation telemetry records 16 malicious detections and 1 suspicious detection, with Fortinet and Sophos among the flagged vendors; blacklist status is true.
• The observed page generated 2 external XHR requests and 2 external POST requests classified as non-whitelisted, with a maximum external activity proportion of 72.6%.
• Archive records show 11 snapshots spanning 2021–2025, covering 5 years, while the registration record states creation in 2026.

Regulatory Verification Notes

The site’s on-page identity is presented through the title “雀魂集团|中国官网,” but the available evidence does not independently verify the operator behind that claim. The page describes a commercial entertainment model involving downloads, in-app purchases, character draws, and potentially premium content; no licensing authority or registration number is claimed in the available business information. This is a disclosure and operator-verification gap rather than, by itself, proof of wrongdoing. The site’s valid transport encryption and identified hosting are technical properties only and do not establish ownership, publisher authorization, or regulatory standing. Evidence:

• The recorded registrar is Metaregistrar BV; the domain creation date is 2026-02-11T19:15:53Z and the recorded age is 0.52 years.
• The site is hosted on AS9294, GNETINC-AS-AP - GNET INC., US.
• The transport certificate is issued by YE2, uses DV validation, and is valid to 2026-11-05T19:03:48+00:00.
• The available business information records no claimed license authority or license number.

What to Verify Next

Before any interaction beyond passive viewing, the purported game publisher and the legitimacy of each download should be confirmed through independently established official app-store or platform listings, not solely through links supplied by this site. Any account or payment activity should wait until the publisher identity, software provenance, privacy terms, refund arrangements, and applicable consumer protections are confirmed through independent channels. Downloaded software should be obtained from a verified platform source and subjected to enterprise malware scanning and code-signature checks where available. Evidence:

• The site’s stated purpose is user acquisition and download distribution rather than a purely informational game guide.
• The observed page contains no sensitive form, but it does direct visitors toward registration and client downloads.
• The page includes external destinations and a support channel, requiring independent confirmation that those destinations belong to the authorized publisher.

Summary Verdict

The overall posture is critical and unsuitable for sensitive interaction. The site’s coherent gaming content does not offset the confirmed external threat detections, unresolved provenance conflict, and lack of independently verified operator identity. Passive reference may be possible, but the evidence does not support trust for credentials, account access, downloads, or financial activity.

Infrastructure Integrity

The site resolves to one likely origin IP without a detected CDN or edge-IP layer. Hosting is provided through GNETINC-AS-AP, and the direct origin posture offers limited infrastructure separation; the presence of basic transport encryption should be regarded only as a narrow protective measure, not as evidence of legitimacy.

Closing Assessment

The appropriate course is to avoid login, credential submission, downloads, and financial transactions through the site, and to use only independently verified official channels until the publisher and software provenance have been established.