metis[.]stakingsreward[.]art

metis.stakingsreward.art is an offline domain that was observed hosting a credential‑phishing page targeting Google users. The site was registered on 21 February 2026 and presented a page title of “Google”, matching the declared brand target. Analysis of the hosting layer shows the domain resolves to 142.250.176.196, an address owned by Google LLC (ASN 15169) in the United States. The presence of a Google‑controlled IP suggests the attacker deliberately leveraged legitimate infrastructure to increase credibility and evade simple IP‑based blocking. The SSL certificate associated with the site is identified as “WR2”, which does not correspond to a known public certificate authority and may indicate a self‑signed or otherwise compromised certificate.

Reputation services flag the domain as high‑risk. Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded detections from 12 of 93 scanning engines. The domain appears on a single external blocklist and has been taken down by the PhishDestroy takedown service. The combination of a brand‑impersonation page title, low trust score, and multiple vendor detections corroborates the classification of the site as a credential‑phishing vector. Uncertainties remain regarding the full phishing kit used and any additional infrastructure that may have been employed before the takedown.

No public Safe Browsing or OTX entries are provided in the current intelligence set, and the short lifespan of the domain limits the ability to capture post‑take‑down activity. Defenders should update their URL filtering and DNS blocklists to include metis.stakingsreward.art and monitor traffic to its resolved IP address (142.250.176.196) for any residual malicious requests. Email security gateways should be tuned to detect messages containing the “Google” brand keyword paired with suspicious links, especially those referencing the .art TLD.