metal-ox-trade[.]biz

The domain metal-ox-trade.biz is currently classified as an active generic phishing infrastructure. Network resolution points to the IPv4 address 65.98.127.26, which has been observed in at least one commercial blocklist and is actively blocked by the PhishDestroy service. A VirusTotal scan conducted on the domain engaged 91 independent scanning engines; at the time of analysis none of the engines reported a detection. The absence of detections does not imply benign intent, and the domain remains listed on a security blocklist, confirming its malicious disposition.

No additional data regarding the registrar, SSL certificate details, HTTP response codes, or page title have been disclosed, limiting the depth of the technical fingerprint. The risk level is marked as “under investigation,” and the operational status is noted as “active,” indicating that the infrastructure may still be used for credential harvesting or related fraudulent activities. Defenders should add metal-ox-trade.biz to deny lists across perimeter firewalls, DNS filtering, and secure web gateways.

Continuous monitoring of outbound connections to 65.98.127.26 is advised, and any internal traffic attempting to resolve or contact the domain should be logged and investigated. Integration of the domain indicator into threat‑intelligence platforms will ensure rapid propagation of the block across security controls. Because the domain lacks a public reputation score, reliance on the existing blocklist entry and the PhishDestroy block is recommended until further intelligence becomes available.