events-meteora[.]xyz

The domain events-meteora.xyz is identified as a generic phishing site specializing in fraudulent event pages designed to harvest user credentials or distribute malicious payloads. Analysis indicates the domain is currently offline, displaying a 504 Gateway Time-out error, though prior activity suggests it was actively used for social engineering campaigns. No specific brand impersonation was confirmed, but the site's structure aligns with credential theft tactics. Infrastructure analysis reveals the domain was registered through Dynadot LLC on March 13, 2026, an unusually future-dated registration likely indicative of bulk domain abuse. It resolves to the IP address 172.67.215.93, a Cloudflare-hosted endpoint leveraging HTTP/3 protocols. Security vendors flagged the domain in 15 of 95 VirusTotal detections, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. The domain appears on three independent security blocklists and was proactively blocked by multiple threat intelligence feeds, including PhishDestroy and ScamSniffer. The unique seed identifier for this campaign is 31d8bc. Current status confirms the domain is offline, though its infrastructure remains intact. Organizations are advised to block the domain and its associated IP (172.67.215.93) at the perimeter, update endpoint protection rules to include the domain hash, and monitor for related subdomains or future registrations under the same registrar. Users who accessed the site should reset credentials for any accounts entered and scan systems for unauthorized activity. Future monitoring of Dynadot-registered domains with similar naming patterns (meteora-themed) is recommended.