# PhishDestroy domain threat record: metricaecorl.pt Content language: English Canonical HTML report: https://phishdestroy.io/domain/metricaecorl.pt/ Machine-readable companion: https://phishdestroy.io/domain/metricaecorl.pt/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-03 18:46:34 UTC - Last availability or vendor check: 2026-10-22 22:32:18 UTC - Stored record updated: 2026-10-22 22:32:18 UTC - VirusTotal detections in the stored snapshot: 7/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-08-31 18:58:11 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06896-dd9a-715b-bb91-0a5d273d6e6f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/metricaecorl.pt - Certificate Transparency search: https://crt.sh/?q=%25.metricaecorl.pt - Web Archive lookup: https://web.archive.org/web/*/https://metricaecorl.pt/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview metricaecorl.pt is a phishing site that presents itself as MetricaCor. The page title reads "MetricaCor" and the domain is a padded variant of that name, so a quick glance at the address bar seems to confirm the brand. PhishDestroy first detected it on 2026-09-03. On 2026-10-19 the site was still online and its content was still being served. How the scam works Impersonation pages copy the look and wording of a known name so visitors act as they would on the genuine site. They type logins, personal details or payment information, or follow instructions that send money or account access to the operator. The domain is built to pass a casual check: it keeps the recognisable "metrica" and "cor" pieces and inserts extra letters that are easy to miss. Anything entered on the page goes straight to the people running it. Evidence On 2026-09-16, 7 of 89 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar and VIPRE. That count is modest, so many security tools will still let the page load without a warning. Other sources back the classification. Spamhaus lists the domain in its DBL as phishing, and the MetaMask and SEAL blocklists include it alongside PhishDestroy. Four AlienVault OTX pulses reference it, which means separate researchers have tracked it as well. Infrastructure The domain was registered on 2026-08-31, three days before PhishDestroy detected it. A newly registered lookalike that goes live almost immediately is typical of a short-lived phishing operation. The site sits behind Cloudflare, Inc. (address geolocated to CA), which hides the origin server. Its certificate comes from Google Trust Services (WE1), so the padlock in the browser says nothing about whether the site is legitimate. What to do Do not enter anything on metricaecorl.pt, and reach MetricaCor only through an address you already know is genuine. If you logged in there, change that password immediately, along with any account that reuses it, and turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and dispute any charges. If you typed a wallet recovery phrase, treat it as compromised and move your funds to a new wallet. Defenders should block the domain at DNS and mail gateways and report it to Cloudflare and the .pt registry. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a06896-dd9a-715b-bb91-0a5d273d6e6f/ VirusTotal report: https://www.virustotal.com/gui/domain/metricaecorl.pt Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=metricaecorl.pt Archived copy: https://web.archive.org/web/20260916200357/https://metricaecorl.pt/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:50:57 UTC ## Stored page captures - Primary capture: https://i.ibb.co/39XnXqjb/66fc35b13d13.png Captured: 2026-09-03 18:46:34 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a06896-dd9a-715b-bb91-0a5d273d6e6f.png Captured: 2026-09-03 18:46:34 UTC Source report: https://urlscan.io/result/01a06896-dd9a-715b-bb91-0a5d273d6e6f/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2ce8321d-5279-419d-8e0a-de3f657d33cc.png Captured: 2026-09-03 18:52:26 UTC Source report: https://radar.cloudflare.com/scan/2ce8321d-5279-419d-8e0a-de3f657d33cc SHA-256: b462cd7016511688e2a3c080e2d4c441f2ba0a74fb5d5cef017d32c3904898ed - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a0688d-892f-7130-88e3-23054ea71e46.png Captured: 2026-09-03 18:35:33 UTC Source report: https://urlscan.io/result/01a0688d-892f-7130-88e3-23054ea71e46/ SHA-256: 381e07a6eb09694e3e85d4668782b392cc893368ada32de95dfecaf20446ca73 - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a0688f-d495-70c8-a494-5dace38222c8.png Captured: 2026-09-03 18:37:37 UTC Source report: https://urlscan.io/result/01a0688f-d495-70c8-a494-5dace38222c8/ SHA-256: e1ee5196161f2adb72a680e56deeb2e56606a4fe8eb44640cd6720d149242767 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:53:04Z", "uuid": "01a06896-dd9a-715b-bb91-0a5d273d6e6f", "scanned_at": "2026-09-03T18:45:19Z", "final_url": "https://metricaecorl.pt/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://metricaecorl.pt/", "from": "http://metricaecorl.pt/", "status": 307 } ], "ip": "104.21.92.211", "domains": [ "fonts.gstatic.com", "static.cloudflareinsights.com" ], "ips": [ "142.250.183.35", "104.16.80.73", "104.21.92.211" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "link_domains": [ "wa.me", "www.facebook.com", "www.instagram.com", "www.tiktok.com" ], "social": [ "https://wa.me/351925774552", "https://www.facebook.com/share/19DggBuY6W", "https://www.instagram.com/metricaycor", "https://www.tiktok.com/@mtrica05" ], "doc_hash": "94fc805f4e23326f986fceff8af6cbe7b9d810664bdf5d5f288aa8a6bece9d27", "script_hashes": [ "aa4232e08906ccf7dda08c38b53fe7b9029b151c2992625dc9995883f064c32f", "b6a410c542a92169a675973cde7161af32103f218011bb380442f2fd90e4b3a9", "73ad3b435d0e0f5c79573ab9a0084102ce0e25e16831974ac14e6c06231f3b79" ], "globals": [ "__cfBeacon" ], "tls": { "san": [ "metricaecorl.pt", "www.metricaecorl.pt", "*.www.metricaecorl.pt" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "metricaecorl.pt", "protocol": "QUIC", "valid_to": "2026-11-29T22:02:39Z", "valid_from": "2026-08-31T21:02:49Z" }, "domain_age_days": 2, "apex_age_days": 2, "tls_age_days": 2, "tls_valid_days": 90, "requests": 19, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 68, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:33:43Z", "uuid": "2ce8321d-5279-419d-8e0a-de3f657d33cc", "scanned_at": "2026-09-03T18:52:26Z", "final_url": "https://metricaecorl.pt/", "status": 200, "history": [ { "url": "https://metricaecorl.pt/", "status": 200 } ], "dom_hash": "b0e24adf67480100515e254f51205cfa4053a1aa3da03866debeff2620d734d3", "doc_hash": "94fc805f4e23326f986fceff8af6cbe7b9d810664bdf5d5f288aa8a6bece9d27", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "metricaecorl.pt", "type": "A", "value": "172.67.198.167" }, { "name": "metricaecorl.pt", "type": "A", "value": "104.21.92.211" }, { "name": "metricaecorl.pt", "type": "AAAA", "value": "2606:4700:3030::ac43:c6a7" }, { "name": "metricaecorl.pt", "type": "AAAA", "value": "2606:4700:3035::6815:5cd3" } ], "dnssec_valid": false, "ip": "172.67.198.167", "whois": { "created": "2026-08-31T20:58:11Z", "expires": "2027-08-31T20:58:11Z", "nameservers": [ "nola.ns.cloudflare.com", "tim.ns.cloudflare.com" ] } } } ```