app-metacard[.]com

This domain, app-metacard.com, operates as a high-risk phishing site specifically designed to harvest cryptocurrency wallet credentials. The site mimics legitimate security verification pages, presenting users with a false 'Securing access' prompt to trick them into entering sensitive login details, seed phrases, or private keys. Such credentials, once captured, grant attackers direct access to victims' digital assets, enabling unauthorized transactions and irreversible fund theft. The threat primarily targets users of decentralized finance platforms and wallet services, exploiting their familiarity with security prompts to bypass caution. Analysis indicates this infrastructure was established on May 10, 2026, and is registered through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar frequently associated with malicious domains. The domain currently resolves to IP address 193.169.194.34, hosted on AS214576 (Berdiev Ruslan Mukhabatovich), an autonomous system with a history of supporting phishing and fraudulent operations. Security vendors have flagged this domain as malicious, with 10 out of 95 engines on VirusTotal detecting it as a phishing threat. Additionally, the domain appears on three security blocklists, and its SSL certificate, issued by Let's Encrypt (R12), is commonly used by threat actors to lend a false sense of legitimacy to fraudulent sites. If you have visited app-metacard.com or entered any credentials on the site, immediate action is required to mitigate potential damage. First, disconnect the affected device from the internet to prevent further data transmission. Next, revoke any active sessions or authorizations granted to the site in your wallet or exchange accounts. Change all passwords and seed phrases associated with the compromised credentials, and transfer any remaining assets to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and report the incident to relevant security teams or fraud response units. Users should also scan their devices for malware, as phishing sites often deploy additional payloads to maintain persistence or exfiltrate data.