648aa6b9e132c[.]site123[.]me

On July 24, 2026, the domain 648aa6b9e132c.site123.me was examined after being reported by PhishDestroy. The domain was created on December 3, 2015 and is registered through GoDaddy.com, LLC. DNS resolution points to the IPv4 address 185.111.111.158, which belongs to ASN AS212238 operated by Datacamp Limited and is geolocated in Germany. The site presents an SSL certificate issued by ZeroSSL under the ZeroSSL RSA Domain Secure Site CA, indicating that TLS is available but does not provide any insight into the content. HTTP requests return a 202 status code, an atypical response for a static page, and the only detected technology is listed as “Bunny”. The page title returned from the server is “financial-journey - Metamask Extension”, directly referencing the MetaMask brand and suggesting a crypto‑related scam.

The infrastructure is classified as a crypto scam that impersonates MetaMask, matching the known brand target. VirusTotal analysis shows that five of ninety‑three scanning engines flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has already blocked the domain, and the Gridinsoft trust score is 0 out of 100, reflecting a high likelihood of malicious intent. Nameserver queries returned no results (NS_NOT_FOUND), limiting further DNS‑based attribution. The current status is offline, indicating that the site has been taken down or is otherwise inaccessible.

Uncertainties remain regarding the exact payload or phishing workflow because the page content has not been captured; only the title and metadata are available. Defensive recommendations include adding the IP address 185.111.111.158 to network deny lists, continuing to block the domain at perimeter and endpoint layers, monitoring for new subdomains under the same registrar or ASN, and reviewing any internal logs for attempts to access the URL or the page title.