meteora-checker[.]com

Analysis of meteora-checker.com indicates that the domain was actively serving a phishing page whose HTML title reads “Nur einen Moment…”. The site resolved to the Cloudflare‑owned address 172.67.189.206, which belongs to ASN 13335 and is geolocated in the United States. Registration data show the domain was created on 15 October 2025 through Dominet (HK) Limited, and the authoritative name servers are christina.ns.cloudflare.com and norm.ns.cloudflare.com. No TLS certificate was presented, implying the site operated over plain HTTP or an invalid HTTPS configuration. VirusTotal recorded four detections out of ninety‑five scanned engines, confirming that multiple security products flagged the domain as malicious.

AlienVault OTX lists the domain in a single threat‑intelligence pulse, and the domain appears on one public blocklist, where it is also listed by PhishDestroy. The current HTTP status is offline, suggesting the site has been taken down or is otherwise inaccessible at the time of this assessment. The evidence collectively confirms that meteora-checker.com was used for a generic phishing campaign. However, the limited number of detections and the single OTX pulse indicate that the operational footprint may be modest or short‑lived.

No additional artifacts such as payload hashes, phishing kits, or targeted brands were identified in the available data. Defenders should continue to block the domain at network perimeter devices, update DNS filtering lists with the observed IP address and registrar information, and monitor for any re‑registration attempts. Continuous observation of Cloudflare‑hosted IP ranges for similar activity is recommended, as the infrastructure can be reused for future campaigns. Organizations that rely on threat‑intel feeds should incorporate the OTX pulse and the PhishDestroy blocklist entry into their correlation rules to improve early detection of related incidents.