contributors[.]meteoras[.]net

The domain contributors.meteoras.net is currently active and has been classified as a generic phishing site. The domain was created on 23 November 2025 and is hosted behind Cloudflare’s network (AS13335), resolving to the IP address 172.67.202.108 in the United States. Service fingerprints show Cloudflare Browser Insights, Cloudflare acceleration, and HTTP/3 support, indicating the use of modern CDN features to obscure origin infrastructure. A valid TLS certificate issued by Google Trust Services (WE1) is present, which can increase perceived legitimacy for unsuspecting users. The site returns an HTTP 403 status code, and the only visible page title is the German phrase "Nur einen Moment…". Threat intelligence shows that the domain appears on a single security blocklist, PhishDestroy, and has a low Gridinsoft trust score of 0 out of 100. VirusTotal analysis reports a single vendor flag out of 95, reinforcing the suspicion that the domain is being used for malicious purposes. The combination of a recent registration, use of a reputable TLS certificate, and reliance on Cloudflare’s anonymizing services is a pattern frequently observed in phishing operations designed to evade takedown attempts and to lend credibility to fraudulent pages. Defenders should immediately block traffic to contributors.meteoras.net at network perimeters and add the domain to internal threat‑intelligence feeds. Continuous monitoring of DNS queries and TLS certificate changes is advised, as the underlying infrastructure could be redirected to new hosts without notice. Given the presence on a known phishing blocklist and the low trust score, it is prudent to include the domain in email gateway filtering rules and to alert end‑users about potential phishing attempts originating from this URL.