metaplay88a-amp[.]xyz

The domain metaplay88a-amp.xyz is currently classified as a high‑risk generic phishing site. It was registered on 11 Nov 2025 through NameCheap, Inc. and is actively resolved to 172.67.219.13, an address owned by Cloudflare, Inc. (AS13335). The site returns HTTP 200 responses and presents a valid SSL certificate issued by Google Trust Services under the WE1 label, indicating proper TLS termination.

Infrastructure analysis shows the domain is served behind Cloudflare’s edge network, with authoritative name servers ariadne.ns.cloudflare.com and ignacio.ns.cloudflare.com. The web stack enumerated by passive scans includes Node.js, React, Next.js, AMP, HSTS, Webpack, and HTTP/3, all typical of modern JavaScript‑heavy sites. Such a stack enables rapid content updates and can obscure malicious payloads behind legitimate‑looking front‑end code.

Threat intelligence signals reinforce the malicious assessment. The domain appears on one public blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal reports that 6 of 95 security vendors flag the domain as malicious, while Gridinsoft assigns a trust score of 0 / 100. The page title “METAPLAY88 : Bukan Website Judol Kaleng2” is the only visible content identifier; no further content analysis is available from the provided data set.

Defenders should prioritize immediate containment. Network‑level controls ought to block traffic to 172.67.219.13 for the affected domain, and DNS‑based filtering should be applied to both name servers. Continuous monitoring of the Cloudflare IP range for similar activity is advised, as the underlying infrastructure can host multiple abuse campaigns. Incident response teams should also consider sinkholing the domain to disrupt any credential‑harvesting attempts while gathering additional forensic evidence.