helm[.]metaquotes[.]business

Analysis indicates the domain helm.metaquotes.business is currently active and has been classified as a generic phishing threat. The domain is listed on one public security blocklist and has been blocked by the PhishDestroy service, suggesting that at least one reputable anti‑phishing vendor has observed malicious use. VirusTotal records show that the domain was submitted for scanning and examined by 91 distinct scanning engines; at the time of the latest check none of those engines reported a detection. While the absence of detections does not constitute confirmation of safety, it indicates that automated signatures have not yet flagged the host.

No public information on the registrar, registration dates, hosting IP address, ASN, SSL certificate details, or HTTP response codes is available in the current intelligence set, limiting the ability to perform a deeper infrastructure assessment. Consequently, defenders should continue to treat helm.metaquotes.business as potentially malicious. Recommended actions include adding the domain to outbound and inbound deny lists, monitoring DNS queries for the name, and employing URL filtering that references the blocklist entry.

Organizations should also consider instrumenting network traffic logs for any connections to the domain and, where feasible, capture TLS handshake metadata for future correlation. Because the domain is flagged by PhishDestroy and appears on a blocklist, any user‑initiated navigation to the site should be blocked or warned. Ongoing observation is advised, and any new intelligence—such as registrar WHOIS data, hosting IP, or page content—should be incorporated into detection rules promptly.