meteora[.]works

The domain meteora.works was observed hosting a wallet/seed phishing campaign that impersonates the brand "across". DNS resolution pointed to the Cloudflare‑owned address 172.67.197.11, and the authoritative name servers were lindsey.ns.cloudflare.com and lochlan.ns.cloudflare.com, indicating that the infrastructure was provisioned through Cloudflare, Inc. The site presented the page title "Home | Meteora", but no TLS certificate was presented, leaving the HTTP connection unencrypted. VirusTotal scans recorded seven detections out of ninety‑five participating scanners, and the domain appears on a single external security blocklist. The Gridinsoft trust score of 0/100 further reflects a malicious assessment. Threat intelligence aggregators have indexed the domain in one AlienVault OTX pulse, and PhishDestroy has listed it as blocked.

The IP address is allocated to AS13335, Cloudflare, Inc., and geolocation services place it in the United States. The domain is currently taken offline, so active probing is not possible at the time of this report. Analysis of the available artifacts confirms that the infrastructure was deliberately leveraged to harvest cryptocurrency wallet seeds, matching the reported scam type. The lack of a TLS certificate and the reliance on Cloudflare’s CDN suggest an attempt to obscure the true hosting environment while benefiting from Cloudflare’s performance and mitigation features. However, the exact phishing landing page content, credential collection method, and any downstream command‑and‑control infrastructure remain unknown because the site is no longer reachable.

Defenders should continue to block meteora.works at the network perimeter and update any URL filtering or DNS sinkhole rules. Monitoring for future resurrection of the domain or for newly registered domains that resolve to the same Cloudflare IP range is advisable, as adversaries frequently recycle IP blocks.