metahash[.]live

This domain is assessed at elevated risk level and classified as generic_phishing. Infrastructure and content indicators suggest impersonation-oriented fraud activity consistent with credential harvesting or deceptive trading portals.

Telemetry data shows VirusTotal detection ratio of 2/95 security vendors. The domain metahash.live was registered through HOSTINGER operations, UAB and created April 11, 2026. It resolves to IP 195.250.26.22. The domain is currently marked offline / taken offline. It is blocked by PhishDestroy and appears on 1 security blocklist. Observed page title is 'Metahash | Trade Us'.

Given the phishing classification, users should treat any historical or cached references to the domain as hostile. Recommended mitigations include blocking DNS resolution for metahash.live and associated IP 195.250.26.22, adding URL and IP-based indicators to enterprise web filters, and ensuring email or browser protections flag any legacy links. No credentials should be entered on any previously accessed pages. Incident response teams should correlate this IOC with proxy logs, endpoint telemetry, and authentication attempts to identify potential exposure. Because the domain is already offline, response efforts should prioritize retrospective impact analysis, including whether users interacted with the site prior to takedown, and enforcing credential resets where reuse may have occurred. Analysts should also incorporate passive DNS review to identify related infrastructure and potential cluster activity tied to HOSTINGER operations, UAB. Patterns of short-lived phishing infrastructure should be considered, including rapid registration-to-activation cycles followed by takedown after detection, even though current live exploitation is no longer possible.