request[.]metadscredit[.]com

PhishDestroy identifies request.metadscredit.com as an active, high-risk domain engaged in crypto-draining credential theft operations. This domain masquerades as a legitimate financial-services portal while hosting malicious scripts designed to exfiltrate wallet credentials and drain crypto holdings. The page itself displays an unprotected directory index, indicating the operator has not yet deployed a convincing landing page—a tactic often used to rapidly iterate on deception before victim traffic spikes. All available telemetry confirms malicious intent and active exploitation. This domain was flagged by 10 out of 95 VirusTotal security vendors, placing it in the top tier of malicious detections. It resolves to IP 188.114.96.3 and was registered on August 19, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Google Safe Browsing has listed the domain under SOCIAL_ENGINEERING, and it holds an SSL certificate issued by Google Trust Services. The combination of recent creation date, low vendor detection rate, and established blocklist presence highlights a rapidly evolving but already dangerous threat infrastructure. Organizations should immediately block request.metadscredit.com at the DNS, firewall, and proxy layers. Users who may have visited the domain should inspect browser extensions for unauthorized wallet-drain scripts, scan endpoints for rogue processes communicating with 188.114.96.3, and audit wallet transaction histories for unauthorized transfers. Given the domain’s low detection rate and active status, assume compromise until proven otherwise and treat all associated infrastructure as hostile.