# PhishDestroy domain threat record: metlifetakealongdentalinsurance.test.ciapps-sandbox.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/metlifetakealongdentalinsurance.test.ciapps-sandbox.com/ Machine-readable companion: https://phishdestroy.io/domain/metlifetakealongdentalinsurance.test.ciapps-sandbox.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-04 16:40:09 UTC - Last availability or vendor check: 2026-10-22 10:29:50 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 150.171.109.194 - Registrar in stored WHOIS data: DNC Holdings, Inc. - Last stored HTTP status: 403 - Registration date (registry RDAP, ciapps-sandbox.com): 2026-05-19 20:55:53 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/metlifetakealongdentalinsurance.test.ciapps-sandbox.com - Certificate Transparency search: https://crt.sh/?q=%25.metlifetakealongdentalinsurance.test.ciapps-sandbox.com - Web Archive lookup: https://web.archive.org/web/*/https://metlifetakealongdentalinsurance.test.ciapps-sandbox.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview This domain carries the page title "MetLife" and a hostname built around a MetLife dental insurance product. It sits on a sandbox-style subdomain with no visible connection to the insurer's own web presence. PhishDestroy first saw it on 2026-09-04 and added it to the blocklist as a suspicious domain. As of 2026-10-19 the site was still online, with its content behind access protection. How the scam works The page presents itself as MetLife, and the hostname reads like a dental coverage offer. That makes it a plausible trap for anyone shopping for or managing a dental plan. Pages that borrow an insurer's name usually ask for personal details, policy or member numbers, account logins or a card payment for a supposed premium. Whatever is typed in goes to whoever runs the site, not to MetLife. The hostname uses a "test" label on a sandbox domain, while PhishDestroy lists it as a suspicious brand lookalike. Evidence On 2026-10-19, VirusTotal showed 5 of 92 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a small share of engines. Still, it comes from five unrelated vendors, so the domain is drawing independent attention rather than a single outlier verdict. Apart from PhishDestroy's own listing, no other blocklist carries it yet. Infrastructure The parent domain was registered through DNC Holdings, Inc. on 2026-05-19, about 108 days before PhishDestroy flagged this hostname. It resolves to Microsoft Corporation cloud address space geolocated in South Africa. A valid GeoTrust certificate issued through DigiCert means visitors see a normal padlock. That says nothing about whether the site is legitimate. What to do If you entered a MetLife or other insurance login here, change that password, plus any account reusing it, and turn on two-factor authentication. If you entered card details or paid anything, contact your bank to dispute the charge and replace the card. If you shared a policy number, date of birth or ID details, call MetLife through the number on your card or official documents to report possible misuse. Security teams should block the hostname at the proxy and DNS layer, search mail logs for messages linking to it, and report it to the hosting provider and registrar. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/metlifetakealongdentalinsurance.test.ciapps-sandbox.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=metlifetakealongdentalinsurance.test.ciapps-sandbox.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 11:03:28 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fdc30ea6-46ce-4804-8c04-b354cc430793.png Captured: 2026-09-14 22:16:05 UTC Source report: https://radar.cloudflare.com/scan/fdc30ea6-46ce-4804-8c04-b354cc430793 SHA-256: 7ceefa3c06cff74435cd358f30507c492a00c58c9e5600f5361dc939cfe1bea5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T00:25:40Z", "uuid": "fdc30ea6-46ce-4804-8c04-b354cc430793", "scanned_at": "2026-09-14T22:16:05Z", "final_url": "https://metlifetakealongdentalinsurance.test.ciapps-sandbox.com/", "status": 200, "history": [ { "url": "https://metlifetakealongdentalinsurance.test.ciapps-sandbox.com/", "status": 200 } ], "dom_hash": "0cfd79fc58f6db725c3788e387145486ec8b6e2984afb5191954ef031bd0ce94", "doc_hash": "47a03cffada6346fdf9078621b1469fe9fe3e3c1513e0f1c2ca250b6a183b85e", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "metlifetakealongdentalinsurance.test.ciapps-sandbox.com", "type": "CNAME", "value": "ude-test-3-fvapgjbsf7gjchcq.a03.azurefd.net" }, { "name": "metlifetakealongdentalinsurance.test.ciapps-sandbox.com", "type": "CNAME", "value": "ude-test-3-fvapgjbsf7gjchcq.a03.azurefd.net" } ], "dnssec_valid": false, "ip": "150.171.109.150", "whois": { "registrar": "DNC Holdings, Inc.", "created": "2026-05-19T20:55:53Z", "updated": "2026-05-28T14:00:15Z", "expires": "2027-05-19T20:55:53Z", "nameservers": [ "walk.ns.cloudflare.com", "zeus.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T11:56:50Z", "analysis_at": "2026-10-19T02:02:11Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 4, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "DNC Holdings, Inc", "created": "2026-05-19T20:55:53Z", "expires": "2027-05-19T20:55:53Z", "updated": "2026-05-28T14:00:15Z", "first_seen": "2026-08-12T22:58:36Z", "dns": [ { "ttl": 300, "type": "CNAME", "value": "ude-test-3-fvapgjbsf7gjchcq.a03.azurefd.net" }, { "ttl": 10, "type": "A", "value": "150.171.110.194" }, { "ttl": 60, "type": "CNAME", "value": "mr-a03.tm-azurefd.net" }, { "ttl": 10, "type": "AAAA", "value": "2603:1061:14:1c2::1" } ], "dns_at": "2026-10-19T02:02:59Z", "jarm": "2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "metlifetakealongdentalinsurance.test.ciapps-sandbox.com" ], "issuer": "DigiCert Inc / GeoTrust TLS RSA CA G1", "serial": "4daccba43b7209cd51a54de562f113d", "sha256": "7fb3ff3b6149e53acd4ec644128dc5475dff1fff0e78779919eb96cca1ba9767", "subject": "metlifetakealongdentalinsurance.test.ciapps-sandbox.com", "valid_to": "2027-02-12T23:59:59Z", "valid_from": "2026-08-12T00:00:00Z" }, "whois": { "registrar": "DNC Holdings, Inc", "registrar_iana_id": "291", "registrar_url": "http://www.directnic.com", "created": "2026-05-19T15:55:53Z", "updated": "2026-05-28T09:00:15Z", "expires": "2027-05-19T15:55:53Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "walk.ns.cloudflare.com", "zeus.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```