metatoy[.]io

This domain, metatoy.io, is flagged as a high-risk generic phishing site designed to mimic legitimate retail or e-commerce platforms. Analysis indicates no direct association with a specific brand, but the infrastructure suggests a broad impersonation campaign targeting online shoppers. The site employs a basic homepage structure, likely part of a larger phishing kit aimed at harvesting user credentials or payment details. No drainer kit signatures have been confirmed at this stage, though the lack of SSL encryption and recent registration raise further suspicions. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on April 07, 2025, through Web Commerce Communications Limited, a registrar frequently observed in fraudulent registrations. It resolves to the IP address 172.67.186.237, hosted on Cloudflare’s network (AS13335), which is commonly abused for anonymization. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) has not yet listed the domain, though this may reflect detection latency rather than legitimacy. The domain remains active as of the latest assessment, with no takedown or mitigation measures observed. Response actions are recommended, including blocking the domain at the network level and monitoring for related infrastructure. The remaining risk is classified as high due to the domain’s recent creation, lack of encryption, and confirmed detections by security vendors. Users are advised to avoid interaction with the site, and organizations should update their threat intelligence feeds to include this indicator of compromise.