help[.]metadscredit[.]com

PhishDestroy identifies help.metadscredit.com as a live phishing page designed to harvest user credentials and crypto wallet access. This domain hosts a fake login interface that impersonates MetadsCredit, a legitimate financial services brand, to trick visitors into surrendering sensitive credentials or private keys. The page, titled 'Index of /', is served from an infrastructure historically associated with credential theft and cryptocurrency theft campaigns, indicating a high-risk threat actor operation with intent to drain funds from compromised accounts. This domain was flagged by 10 out of 95 VirusTotal security vendors and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. help.metadscredit.com was created on August 19, 2025, and is currently resolving to IP address 188.114.96.3. Google Safe Browsing classifies it under the category 'SOCIAL_ENGINEERING', confirming active abuse. The presence of a Google Trust Services SSL certificate does not indicate legitimacy—it is commonly abused in phishing campaigns to lend false credibility. The combination of low registration age, high VirusTotal detection rate, and blocklist inclusion signals an active and evolving threat with high confidence of malicious intent. Users who visited help.metadscredit.com should immediately cease interacting with the site and revoke any credentials entered. Check browser extensions for unauthorized permissions and scan devices for malware using up-to-date antivirus tools. If crypto wallet access was provided, transfer remaining assets to a newly generated, offline wallet and revoke any connected dApp permissions using blockchain explorers or wallet interfaces. Report the domain to PhishDestroy for deactivation and warn others in your network. Even if no credentials were entered, isolate the device used for access and monitor for signs of compromise, including unusual outbound connections or unauthorized account activity.