app[.]stake-meteora[.]com

Analysis of app.stake-meteora.com indicates this domain is associated with a crypto drainer scam, currently offline as of July 24, 2026. The domain was registered on October 24, 2025, through Dominet (HK) Limited, a registrar frequently observed in fraudulent infrastructure. It resolves to IP address 172.67.153.132, hosted on Cloudflare's network (AS13335), a common choice for both legitimate and malicious services due to its privacy and resilience features. The domain is flagged by five security vendors on VirusTotal, though the specific detection rules are not disclosed in the available data. It appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer, both of which specialize in cryptocurrency-related fraud detection.

Infrastructure analysis reveals the domain uses Cloudflare nameservers (kenia.ns.cloudflare.com and marty.ns.cloudflare.com), a pattern consistent with threat actors seeking to obscure hosting origins and evade takedowns. The absence of an SSL certificate is atypical for financial or staking platforms, further suggesting malicious intent. The page title, 'Staking period - Meteora,' aligns with the reported scam type, implying the domain was designed to mimic a legitimate cryptocurrency staking service to deceive users into connecting wallets or transferring funds. Defenders should treat this domain as high-risk for crypto-related fraud.

While the site is currently offline, the infrastructure remains registered and could be reactivated. Recommended actions include monitoring for DNS reactivation, blocking the domain and associated IP at network perimeters, and alerting users to potential wallet-draining threats linked to this domain. The registration date and Cloudflare hosting do not alone confirm malicious activity but, combined with blocklist entries and vendor detections, provide sufficient evidence to classify this as a confirmed threat. No further content analysis is available, as the site is inaccessible.