meteora-claim[.]live

Analysis indicates that meteora-claim.live is an active crypto drainer phishing domain, currently flagged as high-risk. The domain resolves to IP address 104.21.18.39 and is served through Cloudflare infrastructure, utilizing HTTP/3 and a valid SSL certificate issued by Google Trust Services. The page title 'Just a moment...' suggests the site is employing anti-analysis or bot-detection mechanisms, a common tactic in phishing operations to delay or evade automated scrutiny. The domain appears on two security blocklists and has been identified in 23 threat intelligence pulses, reinforcing its classification as malicious. Gridinsoft assigns a trust score of 0/100, and five security vendors flag the domain as harmful, though the absence of a full scan from all vendors limits the scope of this assessment. The phishing kit in use is categorized as an 'Airdrop Scam,' a type of attack designed to trick users into connecting wallets to malicious smart contracts, resulting in unauthorized fund transfers. Defenders should treat this domain as an active threat, block resolution at the DNS level, and monitor for related indicators of compromise, including the IP address and SSL certificate issuer. While the domain's registration details point to Cloudflare, this is not uncommon for malicious sites leveraging privacy services to obscure ownership. Further investigation into associated infrastructure may reveal additional linked domains or campaigns.