metis[.]portal-drops[.]sbs

This domain, metis.portal-drops.sbs, has been identified as a brand impersonation threat specifically targeting Google. Analysis indicates the domain is currently offline, though prior activity suggests an attempt to deceive users by mimicking Google’s official branding and interface. The page title explicitly displayed 'Google,' reinforcing the intent to mislead visitors into believing the site was legitimate. Infrastructure analysis reveals the domain was registered on October 20, 2025, through Dynadot LLC, a registrar frequently associated with suspicious or malicious domains. It resolves to the IP address 142.250.184.196, which, while not inherently malicious, has been linked to transient or ephemeral hosting patterns typical of phishing operations. The domain appears on one security blocklist and is flagged by 2 of 95 vendors on VirusTotal, indicating low but notable detection rates. No additional trust scores or historical reputation data are available, further suggesting its recent and potentially short-lived deployment. Given the current offline status, the immediate risk to users is reduced, though the domain’s infrastructure remains a potential threat vector. Organizations and individuals are advised to block this domain at the network level and monitor for any reactivation attempts. Security teams should review logs for prior connections to 142.250.184.196 or interactions with metis.portal-drops.sbs, particularly those involving Google-branded services. Proactive measures, such as updating endpoint protection rules and educating users on brand impersonation tactics, are recommended to mitigate future risks associated with similar threats.