metesora[.]ink

Analysis of metesora.ink indicates active brand impersonation targeting Google, classified as high-risk. The domain was registered on April 20, 2026, through NameCheap, Inc., and remains operational with a 200 HTTP status. Infrastructure analysis reveals Cloudflare hosting (IP 188.114.97.3, CA) with nameservers apollo.ns.cloudflare.com and meera.ns.cloudflare.com. The SSL certificate is issued by Let's Encrypt (E8). The page title 'Staking | Meteora' suggests a cryptocurrency or staking-themed scam, though the exact content and mechanics are not yet analyzed. Defenders should note the domain appears on three security blocklists (PhishDestroy, MetaMask, SEAL) and is referenced in one AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, and five of 91 security vendors flagged the domain in VirusTotal scans. The scam type is explicitly labeled as impersonation, with no evidence of additional payloads or multi-stage attacks at this time. No legitimate association with Google or Meteora is confirmed. Organizations should block resolution to 188.114.97.3 and monitor for related domains using the same nameserver infrastructure or registration pattern. Further investigation into the staking-themed content is recommended to determine if this is part of a broader crypto-drainer campaign.