metropolisfinb[.]com

The domain metropolisfinb.com was registered on October 13 2024 through Dynadot LLC. It currently resolves to the IPv4 address 198.12.80.250, which is announced by AS36352 (HostPapa) and geolocated to the United States. The site returns HTTP 200 and presents the page title “Home”. SSL is provided by Google Trust Services under the WE1 certificate, indicating a valid TLS configuration.

Technical profiling shows the site runs on a WordPress stack backed by MySQL and PHP, and includes client‑side libraries such as Backbone.js, Underscore.js, Slider Revolution, as well as third‑party widgets like Smartsupp and Google Maps. The presence of a single authoritative nameserver is noted, and the Gridinsoft trust score is 0 out of 100, reflecting a severely compromised reputation.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting the brand “across”. VirusTotal has flagged 15 of 95 scanned samples, and AlienVault OTX lists the domain in one pulse. It is also listed on a public security blocklist and has been actively blocked by PhishDestroy. The scam type is identified as cryptocurrency, and the overall risk rating is high with an active status.

Defenders should treat any traffic to metropolisfinb.com as malicious. Network filters should block the host name and its IP address, and email gateways should quarantine messages that reference the domain. Continuous monitoring of DNS queries for this FQDN is advised, and incident response teams should investigate any credential or cryptocurrency‑related artifacts that may have been exposed. Because the site is hosted on a shared hosting provider, further reconnaissance of adjacent domains in the same IP range may uncover additional malicious actors.