metorix[.]cam

This domain, metorix.cam, is flagged as a cryptocurrency wallet phishing site designed to harvest user credentials and private keys. Analysis indicates no direct association with known legitimate brands, though the page title 'MetoriX' suggests an attempt to mimic cryptocurrency services or platforms. No specific drainer kit signatures were identified in initial scans, but the domain exhibits characteristics consistent with credential theft operations targeting wallet users. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 38.55.204.124 and employs technologies including Vue.js, Nginx, HSTS, and HTTP/3. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on 3 security blocklists. The domain currently holds a Gridinsoft trust score of 0/100, further indicating its high-risk nature. No entries were found in Google Safe Browsing at the time of analysis. The domain has been taken offline, reducing immediate exposure risk. However, historical DNS records and residual cache may still pose a threat to users who accessed the site prior to its removal. Response actions include continued monitoring for re-registration or migration to alternative domains. Organizations and users are advised to block the domain and its associated IP at the network level, and to verify wallet security if interaction with the site is suspected. Remaining risk includes potential secondary domains operated by the same threat actor.