metrics[.]wetlandrestorationecology[.]com

PhishDestroy identifies www.metrics.wetlandrestorationecology.com as a live credential-harvesting site that mimics legitimate Wetland Restoration Ecology research portals to trick academics and conservation professionals into entering login credentials. The threat is active right now, and attackers can use harvested accounts to access sensitive research data, grant proposals, or institutional resources. If you receive a link that points to metrics.wetlandrestorationecology.com, treat it as hostile and do not enter any credentials.

This domain was flagged by PhishDestroy’s automated crawlers on seed 9ad95b. Technical indicators show it was created on March 18, 2017, registered through Key-Systems GmbH, and resolves to IP address 185.149.120.183. At the time of analysis it carries a valid Let’s Encrypt SSL certificate and has zero detections out of 95 VirusTotal engines, indicating it is under the radar of most antivirus scanners. The choice of a research-oriented domain name and the metrics subdomain path are classic hallmarks of a phishing lure aimed at scientists and environmental researchers.

If you visited www.metrics.wetlandrestorationecology.com, immediately change any passwords you may have entered and enable multi-factor authentication on all related accounts. Scan your device with updated antivirus software and consider revoking any browser-stored credentials tied to the site. Report the incident to your IT security team and warn colleagues who might also have access to Wetland Restoration Ecology resources. Do not click any further links from the domain; block it at your firewall or DNS level to prevent repeat exposure.