metrourbanbridge[.]com

On July 25, 2026, analysis of metrourbanbridge.com identified a recently registered domain that appears to be used for a crypto‑related scam. The site presented the page title "Home - Metro Urban," suggesting an attempt to masquerade as a legitimate Metro Urban entity, although no additional branding or content evidence is available. The domain was created on March 11, 2026 and is registered through TuringSign Inc. d/b/a Cosmotown, with authoritative nameservers ns1.hostcreed.com and ns2.hostcreed.com. Network resolution points to IP address 192.142.54.88, which is hosted in the Netherlands and belongs to AS214036 (Ultahost, Inc.).

The web server runs LiteSpeed and serves content over HTTP/3, employing PHP, Tailwind CSS, Alpine.js, and external assets from jsDelivr. The site secured its HTTPS connection with a Let’s Encrypt R13 certificate, indicating a valid but freely issued TLS certificate. Security telemetry shows the domain appears on one public blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scanning recorded detections from two of ninety‑five security vendors, reinforcing the malicious classification.

The current operational status is offline, which limits real‑time observation of payloads or credential‑harvesting mechanisms. Defenders should continue to block the resolved IP address and the domain at perimeter filters, monitor for any re‑hosting attempts, and update threat‑intel feeds with the registration and hosting details. Because the site’s content has not been captured, the exact phishing flow, targeted user demographic, and cryptocurrency extraction methods remain uncertain; further sandbox analysis should be pursued if the domain reappears online.