metashift-ua[.]com

This domain, metashift-ua.com, is confirmed to host a phishing site masquerading as a legitimate advertising portal. Analysis indicates the site impersonates a business advertising service, likely targeting Ukrainian-speaking users with the false promise of business growth through advertising solutions. The domain is currently offline, but prior activity suggests it was designed to harvest credentials or distribute malicious payloads under the guise of marketing services. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 10, 2026, an anomalous future date indicating potential domain spoofing or registry manipulation. It resolved to the IP address 172.67.189.163 and was flagged by 6 of 95 security vendors on VirusTotal. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy. The domain appears on one security blocklist and was previously blocked by PhishDestroy, further corroborating its malicious nature. The domain has been taken offline, but similar threats may persist. Organizations are advised to block the domain and its associated IP (172.67.189.163) at the perimeter. Security teams should monitor for related domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to the same IP range. End-users should be educated to verify advertising service legitimacy through official channels and report suspicious domains to their security providers.