prod-appro-metabase[.]progicar-internal[.]io

This domain, prod-appro-metabase.progicar-internal.io, is identified as a brand impersonation threat targeting Metabase, a business intelligence and data analytics platform. The domain presents a fraudulent login page titled 'Se connecter · Metabase,' designed to harvest user credentials by mimicking the authentic Metabase interface. Analysis indicates the page employs social engineering tactics to deceive users into entering sensitive information, which could be exploited for unauthorized access to corporate or personal data systems. Infrastructure analysis reveals the domain was registered on October 04, 2022, through GANDI SAS and resolves to the IP address 51.158.101.28. It is flagged by 4 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and is currently offline. Detected technologies include Apache HTTP Server, HSTS, and Google Analytics, which may have been leveraged to enhance the legitimacy of the phishing page or track victim interactions. Users who visited this domain or entered credentials on the fraudulent login page should immediately reset their Metabase and any reused passwords across other platforms. Organizations are advised to monitor for unauthorized access attempts and review logs for interactions with the domain or its associated IP address (51.158.101.28). If the domain is encountered in active environments, it should be blocked at the network level to prevent further exposure. Security teams should also assess whether any internal data was compromised and implement additional authentication measures, such as multi-factor authentication, to mitigate future risks.