metaxwin[.]com

Analysis indicates that the domain metaxwin.com is currently active and classified as a generic phishing site with an elevated risk rating. The domain resolves to the IP address 104.21.82.71, which is associated with a large content‑delivery network and does not provide direct attribution to a specific malicious actor. The domain has been flagged by eight of ninety‑one security vendors on VirusTotal, demonstrating moderate detection consensus. It is listed on a single external blocklist and is actively blocked by the PhishDestroy mitigation service.

No additional telemetry such as registrar details, SSL certificate information, HTTP response codes, or page title has been disclosed, leaving the content and exact phishing vector unverified. Consequently, the precise credential‑harvesting technique and targeted brand remain unknown. Defenders should prioritize immediate containment by adding metaxwin.com to network‑level deny lists, DNS sinkhole configurations, and endpoint web‑filter policies.

Continuous monitoring of outbound connections to the IP 104.21.82.71 is advised, as well as periodic re‑evaluation of VirusTotal and blocklist feeds for any changes in detection counts. Because the domain’s infrastructure is hosted on a shared network, related subdomains may be leveraged in future campaigns; therefore, broader CIDR‑level blocking of the hosting provider’s address space should be considered where operationally feasible. Regular threat‑intel updates and user awareness training on credential‑phishing attempts will further reduce exposure.