Security engines reporting a detection: 19. Public blocklists reporting a match: 2. Exercise extreme caution — do not enter credentials or personal information.
ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@iqweb.io.
The latest stored availability evidence still shows the domain reachable; 2 months has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations.
This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
Stored registration data identifies Trustname / Fewmoretaps OÜ (IANA 4318) as the registrar. PhishDestroy maintains a separate registrar investigation; that material is contextual and is not an independent detection for this domain.
The domain metadao-dex.com was registered on July 22 2026 through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IPv4 address 186.2.175.109 and is served by four authoritative name servers – ares.trustname.com, zeus.trustname.com, ns1.anycastdns.cz, and ns2.anycastdns.cz. VirusTotal records show that five of ninety‑one scanned security vendors flagged the domain, indicating a non‑trivial detection rate among automated scanners. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy service, reinforcing the view that it is being used for malicious purposes.
No additional public intelligence such as Safe Browsing verdicts, Open Threat Exchange reports, SSL certificate details, HTTP response codes, or page‑title information is currently available, so the exact content and targeted brand remain unverified. Analysis of the infrastructure suggests a short‑lived registration coupled with the use of Anycast DNS providers, a pattern frequently observed in phishing campaigns that aim to evade takedown efforts. The presence of multiple trust‑named name servers may indicate an attempt to lend legitimacy to the domain, while the IP address 186.2.175.109 is not associated with a well‑known hosting provider in public records, limiting immediate attribution. The five vendor detections and the blocklist entry provide enough confidence to classify the domain as high‑risk for phishing activity, even though the specific victim lure has not been captured.
Defenders should add metadao-dex.com to local deny lists, enforce URL filtering, and monitor outbound traffic for connections to 186.2.175.109. Security solutions that integrate VirusTotal or PhishDestroy feeds will already flag the domain, but manual rule sets can reduce latency. Continuous re‑assessment is advised; additional evidence such as page titles, SSL fingerprints, or observed phishing email samples would refine the threat profile and support takedown requests.
Detection-evasion analysis
Cloaking suspected: scanner and visitor titles differ
Not yet scannedNo crawler-versus-browser difference has been recorded yet
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-14 10:07:58 UTC
RDAP registrationUnknown
Observed timelinelast reachable: 2026-10-14 10:07:58 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Technologies · 1 identified
D
DDoS-Guard
Security
DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.
Google PageSpeed Insights — mobile performance audit of metadao-dex.com· checked Jul 30, 2026
77
Needs Work
Performance
FCP
3.59s
First Contentful Paint
LCP
3.59s
Largest Contentful Paint
CLS
0.124
Cumulative Layout Shift
TBT
0ms
Total Blocking Time
SI
3.89s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good50-89 Needs Work0-49 Poor
Stored Capture Evidence 1 snapshot
Timestamped response metadata retained by the local collection pipeline. Each value below belongs to the displayed archive time.
Archived HTTP responseHTTP 200
Requested URL:https://metadao-dex.com/
MetaDAO DEX — #1 Exchange Protocol on Solana | Swap, Bridge, Pool & Stake
MetaDAO DEX is the fastest exchange protocol on Solana. Swap tokens, bridge assets cross-chain, provide liquidity, stake SOL, and earn real yield — all in one platform. Sub-second trades, near-zero fees. metadao-dex.com
Response HTTP 200
HTML body 75.1 KB
Compressed 14.3 KB
Links 32 internal · 0 external
Selected response headers
Server: ddos-guard
Content-Type: text/html
Content-Encoding: gzip
Security headers present
Content-Security-Policy
HSTS: not observedDNSSEC: not observedWAF / firewall: not observedCloaking flag: not observed
Open Graph title:MetaDAO DEX — #1 Exchange Protocol on Solana
Open Graph description:Swap, bridge, pool, stake & earn on Solana's fastest exchange protocol. Sub-second execution, ultra-low fees, real yield.
Twitter card:summary_large_image
Saved response-header values · 12
Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
14823
Content-Security-Policy
upgrade-insecure-requests;
Content-Type
text/html
Date
Thu, 30 Jul 2026 19:31:47 GMT
Etag
"12c54-6573767d389f9-gzip"
Keep-Alive
timeout=60
Last-Modified
Wed, 22 Jul 2026 18:35:36 GMT
Server
ddos-guard
Vary
Accept-Encoding
Values retained by the collector; long values may be shortened during collection.
Forensic History & Detection Timeline
ThreatLifecycleTelemetry
This timeline displays historical security and status checkpoints observed by the PhishDestroy automated monitoring network. It records domain lifecycle updates, scanner changes, and threat telemetry over time.
Threat First Observed2026-07-30 14:04:21 UTC
Domain ingestion complete. Initial state is marked as alive pointing to IP 186.2.175.109.
Threat Response Pipeline
Discovery
Analysis
Notifications
Monitoring
14 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
Threat Ingested
metadao-dex.com detected and queued for full analysis
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
The domain remains reachable or access-restricted; future checks may update this observation.
How we investigate & report
Public scans, evidence and abuse channels
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups+
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels+
Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
Send the report. Keep outgoing report records and recipient information when available.
Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
PDF notice generated Notice text archived (650 chars)
Abuse notice text as sent to the provider
Policy Violations:
Illegal Activities: Active phishing operation targeting victims
Fraud & Deception: Impersonation of legitimate services
Identity Theft: Collection of credentials under false pretenses
Applicable Laws (Unknown):
International Anti-Cybercrime Regulations
Budapest Convention on Cybercrime
Universal Fraud Prevention Laws
Phishing activities violate international cybercrime conventions and Unknown's domestic fraud laws.
Action Required: This evidence-backed report demonstrates clear violations requiring suspension per your policies. Continued hosting exposes your organization to regulatory scrutiny and potential legal liability.
7 evidence signal groups linked1 reports recordedLast known active
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials.Learn more about recovery fraud →
Template-based draft · optional AI wording assistance requires separate consent
Template-based draft • optional AI wording assistance requires separate consent · Review and submit it yourself
Related Infrastructure & Reports
Stored relationships are grouped by the exact matching attribute. A shared provider or registrar alone does not prove common ownership.
Direct link Shares a registration or an identical phishing kit.
Supporting signal Shares infrastructure or a target brand; not proof of one operator.
Discovery only Listed for navigation; no shared attribute with this host.
Infrastructure map · metadao-dex.com
Each lane is one reason a domain is linked to this host. Node size marks VirusTotal detections and dashed nodes are already offline. The full lists follow below.
Report 
(BY)
PhishDestroy Investigation
