xn--meteor-uta[.]com

Analysis of the domain xn--meteor-uta.com, observed on July 24, 2026, indicates that the site was deployed as a generic phishing portal targeting travelers. The page title returned by the live host, "Meteora Tours with Dayna Stewart | Authentic Greek Adventures," suggests an attempt to masquerade as a legitimate travel‑oriented service, though no further content was captured before the infrastructure was taken offline. Technical fingerprints show the domain resolving to the IPv6 address 2a06:98c1:3121::3, which is announced by AS13335, the Cloudflare network. Both authoritative name servers, earl.ns.cloudflare.com and kiki.ns.cloudflare.com, belong to Cloudflare, confirming the use of a reputable CDN for anonymity and traffic obfuscation. The SSL certificate presented is issued by Google Trust Services under the WE1 profile, indicating that TLS termination was handled by Google’s certificate authority, a common practice for sites hosted behind Cloudflare.

Detected web technologies include a Google Web Server, strict transport security (HSTS), and HTTP/3 support, further confirming the reliance on modern Cloudflare edge services. The domain was registered on March 11, 2025 through Dynadot LLC, a registrar frequently associated with disposable or short‑lived malicious domains. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and an independent blocklist flagged the host, resulting in its removal by the PhishDestroy mitigation service. VirusTotal analysis reports a single positive detection out of 95 scanned vendors, indicating that at least one security engine identified the site as malicious.

No additional intelligence such as OTX indicators, Safe Browsing status, or detailed payload samples were available at the time of analysis. The limited detection footprint and rapid takedown suggest a short‑duration campaign, likely aimed at harvesting credentials or personal data from unsuspecting travelers.