register-metis[.]xyz

The domain register-metis.xyz was observed hosting a malicious site that claims to be associated with the Ethereum Layer 2 Rollup platform Metis while impersonating the financial brand Argent. It was created on February 21, 2026 and resolves to the IPv6 address 2606:4700:3035::6815:521b, which is registered to the United States under AS13335 Cloudflare, Inc. The presented SSL certificate is identified as WE1. Threat intelligence indicates the domain appears on two security blocklists and has been explicitly blocked by PhishDestroy and ScamSniffer.

VirusTotal analysis shows ten of ninety‑three security vendors flag the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high confidence of abuse. The site is currently offline, but the elevated risk level reflects the combination of brand impersonation and cryptocurrency fraud, which could enable credential harvesting or unauthorized fund transfers.

Defenders should add both the domain and its IPv6 host to network‑level deny lists, ensure web filtering solutions incorporate the listed blocklist entries, and monitor Cloudflare’s address space for similar reuse. Correlation of the page title “Ethereum Layer 2 Rollup platform - Metis” and the Argent impersonation with existing SIEM rules will improve detection of any future re‑activation. Continuous monitoring of threat‑intel feeds for related indicators is recommended to mitigate repeat exploitation.