metesora[.]cfd

This domain, metesora.cfd, is actively flagged as a high-risk brand impersonation threat targeting Google. Registered on April 20, 2026, through Namecheap, the domain currently resolves to IP address 188.114.97.3, hosted under CloudFlare, Inc. infrastructure in Canada. Analysis indicates the domain is still operational, returning an HTTP 200 status with a page title of 'Just a moment...', a common placeholder observed in phishing kits during initial deployment or evasion attempts. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its classification as malicious. Infrastructure review reveals the domain uses CloudFlare nameservers (apollo.ns.cloudflare.com and meera.ns.cloudflare.com) and an SSL certificate issued by Let’s Encrypt (serial E7). While CloudFlare’s proxy service obscures direct server details, the use of a widely trusted certificate may be intended to lend superficial legitimacy to the site. Two out of ninety-five security vendors on VirusTotal have flagged metesora.cfd, a relatively low detection rate that may reflect either recent deployment or evasion techniques. AlienVault OTX records the domain in at least one threat intelligence pulse, confirming its presence in active threat tracking systems. The exact nature of the phishing content remains unconfirmed, as the page title does not provide sufficient detail. However, the domain’s classification as a Google impersonation scam suggests it may attempt to harvest credentials, distribute malware, or facilitate fraudulent transactions under the guise of a legitimate service. Defenders should treat this domain as hostile and implement blocking at the DNS or network level. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats in this campaign. Given its continued activity and high-risk designation, immediate containment is recommended.