metanodespro[.]net

This domain, metanodespro.net, is actively serving a phishing page with the title 'Website Suspended Contact Hostwinds Support,' indicating an attempt to impersonate Hostwinds support infrastructure. Analysis reveals the domain was registered on October 23, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to IP address 142.11.215.163. The site appears on five security blocklists, including Polkadot, Codeesura, and PhishDestroy, and has been referenced in 23 threat intelligence pulses on AlienVault OTX. While only three of 95 security vendors on VirusTotal flag the domain, the discrepancy between vendor detections and blocklist presence suggests evolving detection coverage. Infrastructure analysis shows the site employs Node.js, Ubuntu, React, Nginx, Next.js, Google Tag Manager, and Webpack, which are consistent with modern phishing kits designed to evade detection. The SSL certificate is issued by Google Trust Services, a common tactic to lend legitimacy to malicious domains. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. Defenders should treat this domain as an active phishing threat targeting Hostwinds users or related services. The exact content of the phishing page remains unanalyzed, but the suspended-website theme is a known social engineering tactic to prompt victims into contacting fake support channels. Given its presence on multiple blocklists and persistent activity, immediate blocking at the network and endpoint levels is recommended. Further investigation into the IP address 142.11.215.163 may reveal additional associated malicious domains.