metr[.]lol

This domain, metr.lol, was identified as a fraudulent site impersonating the Meteora token distribution platform. Registered on November 20, 2025, through Porkbun LLC, the domain resolved to IP address 72.62.36.205 hosted in Germany by Hostinger International Limited (AS47583). The page title was recorded as 'Meteora | Token Distribution,' which aligns with the scam type of a fake airdrop. The domain did not use SSL encryption, indicating no secure connection was offered to visitors.

Analysis of the domain's infrastructure shows that its nameservers are ns1.dns-parking.com and ns2.dns-parking.com, a common setup for parked or temporary hosting. The domain appears on one security blocklist and is flagged by 12 of 95 security vendors on VirusTotal, with PhishDestroy also blocking it. Gridinsoft assigned a trust score of 0/100, reflecting high suspicion. The risk level was rated as elevated due to the brand impersonation of a known cryptocurrency distribution service.

As of the report date of July 23, 2026, the domain is offline, suggesting it was taken down by hosting providers or registrar action. Defenders should monitor for similar domain registrations under the 'meteora' brand and review logs for any users who may have visited the site, as the absence of SSL and the fraudulent airdrop intent could have led to token theft or credential compromise. The exact content of the page was not captured, so the full scope of the phishing kit remains unconfirmed.