metroprimefinance[.]com[.]sterlingheritagefinance[.]com

This domain, metroprimefinance.com.sterlingheritagefinance.com, operates as a brand impersonation scheme specifically targeting American Express customers. The site presents itself as a legitimate financial institution under the name Metropolitan Heritage Finance, using deceptive branding to trick users into divulging sensitive account credentials, personal information, or financial details. The page title, Metropolitan Heritage Finance- Your New Favorite Bank, mimics the language and tone of established banking institutions, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Analysis of the domain infrastructure reveals multiple indicators of malicious activity. The domain was registered on July 29, 2025, through HOSTINGER operations, UAB, and currently resolves to the IP address 163.61.188.5, hosted on AS153568 (NEW DHAKA HARDWARE) in the United States. Security vendors have flagged the domain, with 1 out of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence platform. Notably, the site lacks an SSL certificate, which is a critical red flag for any financial service claiming legitimacy, as it exposes user data to interception during transmission. Users who have visited metroprimefinance.com.sterlingheritagefinance.com should take immediate action to mitigate potential risks. If any personal, financial, or login credentials were entered on the site, users should assume compromise and change all associated passwords, particularly for their American Express accounts. Enable multi-factor authentication on all financial and sensitive accounts to add an additional layer of security. Monitor bank and credit card statements for unauthorized transactions and consider placing a fraud alert or credit freeze with major credit bureaus. Report the incident to relevant financial institutions and cybersecurity authorities to assist in tracking and mitigating the threat. Users should also scan their devices for malware, as brand impersonation sites often serve malicious payloads or redirect to exploit kits.