metropolisswift[.]com

The domain metropolisswift.com was registered on February 21, 2026 through NameCheap, Inc. and resolves to the IP address 199.188.200.39, which is owned by AS22612 Namecheap, Inc. and geolocated in the United States. An SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 validates the host, and the site returns an HTTP 302 redirect, indicating that visitors are immediately forwarded to another location. Infrastructure analysis shows the server is powered by LiteSpeed and runs PHP, common choices for quickly deployed phishing kits.

Trust scoring from Gridinsoft assigns a zero out of one hundred, reflecting an extremely low reputation, and the domain appears on at least one external security blocklist. PhishDestroy has already added the domain to its block list, and VirusTotal reports that two of ninety‑three scanning engines have flagged the site, providing additional vendor‑level corroboration of malicious intent. The page title returned from the host is simply "index," and no further content has been captured, leaving the exact phishing payload or impersonated brand unconfirmed.

MX records are present, pointing to mx1-hosting.jellyfish.systems with priority 5 and a secondary host at priority 10, while the authoritative name servers are dns1.namecheaphosting.com and dns2.namecheaphosting.com. Given the combination of a newly created domain, zero trust score, active blocklist entries, redirect behavior, and limited vendor detections, the domain should be treated as high‑risk and actively blocked at network perimeters. Defenders are advised to update URL filtering rules to include metropolisswift.com, monitor for any related C2 activity tied to the same IP range, and continue to review any future payload captures that may emerge from this infrastructure.