metabase[.]hibarr[.]net

The domain metabase.hibarr.net was observed with a page title of “Login · Metabase,” indicating an attempt to collect credentials. The domain was created on March 25, 2025 and is currently taken offline, which prevents real‑time content inspection but does not negate the prior malicious activity. DNS resolution points to the IPv4 address 185.207.250.22, hosted in France under AS51167 owned by Contabo GmbH. The authoritative nameservers are scott.ns.cloudflare.com and stevie.ns.cloudflare.com, both belonging to Cloudflare’s DNS service, a common choice for threat actors seeking rapid DNS changes and resilience.

No TLS certificate is presented for the domain, confirming that the site was served only over HTTP, a characteristic often seen in credential‑stealing pages designed to avoid the overhead of certificate procurement. Registration was performed through NameSilo, LLC, a registrar frequently used by both legitimate and malicious registrants due to its low cost and minimal verification requirements. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing the view that it was identified as a phishing vector. VirusTotal analysis shows that 2 of 95 scanning engines flagged the domain, providing independent confirmation of malicious intent, though the low detection count suggests limited exposure or recent emergence.

The supplied intelligence classifies the campaign as a “Crypto Scam,” implying that any harvested credentials were likely intended for unauthorized access to cryptocurrency services or wallets. Because the site is offline, investigators cannot verify the exact payload or any additional infrastructure components, leaving the extent of the compromise uncertain. Defenders should immediately add 185.207.250.22 to network deny lists, block the domain at DNS resolvers, and monitor for any related subdomains that may be registered under the same registrar or nameserver configuration.