partner-console[.]credit-agency-meta[.]com

PhishDestroy identifies partner-console.credit-agency-meta.com as an active drainer-kit domain masquerading as a credit-agency console. The page impersonates a legitimate financial portal to trick users into connecting cryptocurrency wallets, initiating covert token transfers to attacker-controlled addresses. No legitimate brand is leveraged; the threat actor operates the domain independently for financial exfiltration.

This domain was flagged with a VirusTotal score of 22/95 security vendors, resolving to IP address 172.66.0.96. It was registered on November 12, 2025 via Gransy, s.r.o., and is covered by a Google Trust Services SSL certificate. Google Safe Browsing (GSB) has already marked the domain as unsafe, and the domain appears on one public security blocklist managed by OISD.

The domain remains active and is currently distributing drainer code to unsuspecting visitors. Users should avoid visiting entirely. Security teams have already taken blocklisting actions; however, network defenses must continue to block the IP and domain at perimeter level. Remaining risk is elevated owing to the live drainer payload and certificate-backed HTTPS session, which can deceive both users and automated scanners if not explicitly blocked.