ces-metawhales[.]info

Analysis of the domain ces-metawhales.info indicates that it is being used for credential harvesting, a form of generic phishing. The domain was submitted to VirusTotal and examined by 91 anti‑malware vendors; none reported a detection at the time of analysis. Absence of detections does not constitute a safety guarantee, but it demonstrates that the current vendor signatures have not yet flagged the site as malicious. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing organization has identified it as a threat.

No additional intelligence such as SSL certificate details, IP address, hosting provider, ASN, or geographic location is presently available. Likewise, the page title, Safe Browsing status, and any Open Threat Exchange (OTX) indicators have not been disclosed, leaving the exact content and target brand of the phishing page unknown. This lack of public artifacts limits the ability to attribute the campaign to a specific threat actor or to confirm the exact credential type being harvested.

Defenders should treat the domain as hostile: network perimeter controls should block outbound and inbound traffic to the domain, DNS filtering should be updated to deny resolution, and endpoint protection policies should be configured to flag any attempted connections. Continuous monitoring of VirusTotal and other threat‑intelligence feeds is recommended to capture any future detections or changes in reputation. Organizations should also educate users about unsolicited login prompts and encourage verification of URLs before credential entry, as the domain appears designed to lure users into providing sensitive authentication data.