meteora[.]red

Analysis of the domain meteora.red, observed on July 24, 2026, indicates that it operates as a wallet/seed phishing platform targeting users of the Across brand. The site presents a page title of "Home | Meteora" and resolves to the IP address 188.114.97.3, which belongs to AS13335 operated by Cloudflare, Inc., located in the United States. Registration details show the domain was provisioned through Cloudflare, Inc., using the nameservers elijah.ns.cloudflare.com and lia.ns.cloudflare.com, and no SSL certificate is present, exposing traffic to potential interception.

Trust scoring from Gridinsoft rates the domain at 0 out of 100, reflecting a complete lack of credibility. Threat intelligence feeds corroborate malicious activity: AlienVault OTX lists meteora.red in a single pulse, and VirusTotal reports that six out of ninety-five scanned security vendors flagged the domain as malicious. The domain appears on one public blocklist and has been actively blocked by the PhishDestroy service.

Current monitoring shows the domain has been taken offline, but historical evidence suggests it was used for seed extraction attacks aimed at cryptocurrency wallets associated with the Across brand. Defenders should continue to enforce network-level blocking of the IP 188.114.97.3 and the domain meteora.red, update intrusion detection signatures to reflect the observed hostnames and lack of TLS, and monitor for any re‑registration attempts that reuse the same infrastructure or naming patterns. Ongoing vigilance is advised, as the threat actor may redeploy the campaign using alternative domains or similar Cloudflare‑based hosting, leveraging the same impersonation technique to harvest wallet credentials.