meteora-app[.]pages[.]dev

PhishDestroy identifies the active crypto drainer site meteora-app.pages.dev, exploiting the Meteora Finance brand to deceive users into connecting wallets. This campaign employs a generic phishing kit designed to siphon cryptocurrency assets under the guise of legitimate DeFi interactions. The domain leverages Cloudflare’s pages.dev subdomain service to obscure its infrastructure, complicating takedown efforts while maintaining a veneer of legitimacy. This domain was flagged with a VirusTotal score of 3/95 detections, indicating it has evaded most AV engines to date. It was registered via Cloudflare, Inc., resolving to IP 188.114.96.3 and currently appears on 2 security blocklists. Google Safe Browsing categorizes the page under SOCIAL_ENGINEERING, confirming active malicious intent. The SSL certificate, issued by Let’s Encrypt, further normalizes the site’s appearance to end-users, increasing the likelihood of successful deception. The campaign remains active despite being blocked by MetaMask and SEAL security systems. PhishDestroy assesses the remaining risk as elevated due to zero detections, low blocklist penetration, and the use of trusted infrastructure services. Users are strongly advised to avoid interacting with any links associated with meteora-app.pages.dev, verify all URLs independently via official sources, and report suspicious activity immediately to wallet providers and threat intelligence platforms. The domain’s use of pages.dev and Let’s Encrypt SSL, combined with a 3/95 VT score, underscores the sophistication of this drainer operation and the urgent need for heightened vigilance in Web3 environments.