metacheck[.]pro

PhishDestroy identifies metacheck.pro as an active crypto drainer domain currently under evaluation. Initial analysis indicates the threat actor employs a drainer script designed to siphon cryptocurrency assets from unsuspecting victims. The domain leverages social engineering tactics, likely mimicking legitimate crypto-related services to deceive users into connecting their wallets. This domain was flagged as part of a broader campaign targeting crypto enthusiasts, with infrastructure observed in active use since its recent registration.

This domain exhibits multiple red flags across several threat intelligence dimensions. First detected on April 14, 2026, metacheck.pro resolves to the IP address 172.67.150.224, which is associated with hosting multiple suspicious domains. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known to host both legitimate and malicious entities, though no immediate ties to bulk registrations were observed. Crucially, VirusTotal currently reports 12 out of 95 engines detecting the domain or its payload, highlighting a critical window of opportunity for threat actors to operate undetected. Let's Encrypt provides the SSL certificate, a common practice among both benign and malicious sites to establish a veneer of legitimacy. The domain remains unlisted on major threat intelligence feeds at this time, underscoring the need for proactive discovery and containment.

Given the active status and the specific threat posed by crypto drainers, immediate action is required to mitigate exposure. Organizations and individuals should block traffic to metacheck.pro and its associated IP, 172.67.150.224, at the network perimeter and DNS level. Users should be warned against interacting with the domain or any associated links, particularly those masquerading as crypto-related services or wallet verifications. Security teams are advised to monitor for connections to this domain in proxy logs, DNS queries, or endpoint telemetry, and to update browser or ad-blocking lists to include this domain as a proactive measure. Additionally, crypto users should be reminded to verify the authenticity of any service requesting wallet connections, use hardware wallets where possible, and scrutinize transaction approval prompts for anomalies. Further investigation into the domain’s infrastructure and payload is ongoing to identify additional indicators of compromise and potential campaign scope.