meteorga[.]top

PhishDestroy identifies meteorga.top as an active brand-impersonation domain targeting Google users. This site mimics the legitimate Google search page to harvest credentials and session tokens, potentially leading to account takeovers and broader network compromise. Upon initial review the domain currently shows zero detections on VirusTotal, remains unlisted by major blocklists, and holds a valid Let’s Encrypt SSL certificate, which may help it evade wary users and perimeter defenses alike. This domain was flagged via external threat-intel feed on March 12 2026; VirusTotal shows 0 detections out of 95 engines, it was created on February 28 2026 through Namecheap Inc, and it resolves to IP address 188.114.96.3. Historical data indicates the IP belongs to Cloudflare’s Anycast network, complicating geolocation-based blocking. Due to its recent registration and low AV coverage, the risk level is conservatively rated “under_investigation,” but early evidence suggests opportunistic credential harvesting. If you visited meteorga.top at any time, cease use of any credentials entered there and rotate those passwords immediately across Google and any linked accounts. Clear browser cookies for google.com and related domains, enable multi-factor authentication on all critical services, and scan connected devices for malware. Report the domain to your security team and consider adding 188.114.96.3 to network blocklists while monitoring for anomalous authentication attempts. 678907