metis[.]advantagauto[.]com

Analysis of metis.advantagauto.com shows a high‑risk, active phishing infrastructure. The domain was registered on July 19, 2022 through Chengdu west dimension digital technology Co., LTD and resolves to the IP address 172.104.149.86, which is mapped to Germany and belongs to AS63949 Akamai Connected Cloud. The host presents an HTTP 302 redirect and serves a TLS certificate issued by Let’s Encrypt (R13), indicating that traffic is encrypted but the certificate provides no authentication of the underlying service. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external security blocklist.

VirusTotal scans report that three of ninety‑five security vendors flagged the domain as malicious, confirming that multiple detection engines consider it suspicious. The page title returned by the server is "advantagauto.com," matching the second‑level domain but offering no evidence of a legitimate brand presence. Nameserver records point to chuangchuang.ns.giantpanda.com and meilan.ns.giantpanda.com, both associated with the same registrar. Detected web technologies include Astro, Google Analytics, Google AdSense, Funding Choices, Cloudflare, and support for HTTP/3, which are commonly used to lend credibility to malicious sites.

The domain is currently blocked by the PhishDestroy service, reinforcing its classification as a phishing resource. While the exact content of the site has not been captured, the combination of a low trust score, vendor detections, blocklist presence, and redirection behavior suggests a deliberate attempt to harvest credentials or deliver fraudulent content. Defenders should add metis.advantagauto.com and its IP 172.104.149.86 to deny‑lists, enforce strict TLS verification, monitor outbound connections for HTTP 302 responses to this host, and consider broader threat‑intel sharing to mitigate potential exposure.