metamak[.]ru

The domain metamak.ru was registered on May 20, 2026 and is currently resolved to the IPv4 address 87.236.16.107, which is hosted by Beget Ltd in Russia. The site serves content over HTTPS using a Let’s Encrypt R12 certificate and responds with HTTP status code 200. The page title is rendered as a garbled Cyrillic string ("Pаскрой своч..."), a common indicator of a malicious landing page designed to evade casual inspection.

Threat intelligence flags the site as a high‑risk generic phishing operation. VirusTotal reports 2 detections out of 95 scanned security vendors, and the domain appears on two known blocklists. Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX includes the domain in a single threat pulse. The site is actively blocked by two external mitigation services, PhishDestroy and MetaMask, confirming that it is being used to lure victims.

While the available data confirms the presence of phishing infrastructure, details such as the specific phishing kit, credential harvesting method, or targeted user base remain unverified. No additional malware payloads have been associated with the domain in public repositories, and the limited number of detections suggests the campaign may be in an early or low‑visibility stage.

Defenders should prioritize blocking metamak.ru at DNS and network layers, enforce URL filtering, and update intrusion detection signatures to include the observed IP address and SSL fingerprint. Continuous monitoring for new resolutions or related subdomains is recommended, as well as user awareness campaigns highlighting the risk of interacting with unknown Russian‑language phishing pages.