metadapplinks[.]xyz

Analysis as of July 25, 2026 indicates that the domain metadapplinks.xyz is being leveraged for a Binance impersonation campaign aimed at harvesting cryptocurrency wallet seeds. The domain was registered on October 30, 2025 through OwnRegistrar, Inc., and resolves to the IP address 63.176.8.218, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in Germany. No TLS certificate is presented, leaving the site accessible only over HTTP. The domain is hosted on nameservers dns1.p02.nsone.net, dns1.p06.nsone.net, dns2.p02.nsone.net, dns2.p06.nsone.net, and dns3, all of which are typical of third‑party DNS services.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious activity. VirusTotal reports that four of ninety‑five scanning engines flagged the domain, reinforcing the suspicion. The site is listed on four public security blocklists and has been actively blocked by anti‑phishing services PhishDestroy, Polkadot, Enkrypt, and Codeesura. The documented scam type is wallet/seed phishing, which aligns with the brand impersonation of Binance.

The current operational status is offline, which limits immediate observation of content; the page title and HTTP response have not been captured, leaving the exact landing page unknown. Defenders should continue to block the domain and its underlying IP at network perimeter, add the associated nameservers to watch lists, and monitor for any re‑activation. Incident response teams handling Binance‑related credential theft should treat any credentials submitted to this domain as compromised. Ongoing intelligence collection should aim to retrieve archived HTTP snapshots to confirm the phishing workflow and to determine whether additional infrastructure, such as command‑and‑control servers, is associated with the IP address.