metrotcapital[.]com

This domain is flagged for elevated-risk brand impersonation targeting Across, a decentralized finance protocol. Analysis indicates the site mimics legitimate Across branding to deceive users into engaging with fraudulent financial services, potentially leading to unauthorized asset transfers or credential compromise. The threat type is classified as brand impersonation, distinct from generic phishing or credential theft, due to its focus on replicating corporate identity and exploiting trust in the targeted platform. Infrastructure analysis reveals the domain metrotcapital.com was registered on June 26, 2025, through NameSilo, LLC, and resolves to the IP address 107.172.61.186. The site employs a Let's Encrypt SSL certificate and leverages technologies including Bootstrap, LiteSpeed, Cloudflare, Swiper, Smartsupp, Slick, jQuery UI, and jQuery, which are consistent with modern web development practices but also commonly abused in malicious campaigns. Detection metrics show the domain appears on one security blocklist, with VirusTotal reporting 1 out of 95 security vendors flagging it as malicious. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its high-risk classification. Mitigation steps specific to brand impersonation threats include immediate domain blacklisting at the network perimeter to prevent user access. Organizations should deploy automated detection rules to identify and block domains registered within the past 90 days that impersonate known brands, particularly those resolving to high-risk IP ranges such as 107.172.61.186. End-users should be educated to verify domain authenticity by cross-referencing official brand communications and checking for discrepancies in SSL certificates, page titles, or subdomain structures. Security teams are advised to monitor for lateral movement or unauthorized transactions originating from internal systems that may have interacted with this domain prior to its takedown.