meteora[.]date

This domain is flagged for elevated-risk brand impersonation targeting the Solana ecosystem. Analysis indicates the site masquerades as a legitimate decentralized exchange (DEX) under the Meteora name, a tactic commonly employed to deceive users into connecting wallets or disclosing private keys. The specific threat type is a crypto asset drainer, where malicious smart contracts or phishing interfaces siphon funds from victims' wallets upon interaction. The page title, 'What is Meteora? Solana’s Rising DEX Overview,' directly mimics educational or promotional content associated with authentic Solana projects, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain meteora.date was registered on October 03, 2025, through NameSilo, LLC, a registrar frequently observed in phishing campaigns due to its low-cost and privacy-friendly registration options. It resolves to the IP address 172.67.212.202, a Cloudflare-hosted endpoint that obscures the true origin of the infrastructure. VirusTotal detection metrics show 16 out of 95 security vendors flagging the domain as malicious, a significant ratio for a newly registered site. The domain appears on one security blocklist (PhishDestroy) and employs Cloudflare Browser Insights alongside HTTP/3, technologies often leveraged to evade detection and enhance performance. The combination of recent registration, brand impersonation, and Cloudflare proxying suggests a deliberate effort to bypass traditional security controls. Mitigation steps for this threat type require a multi-layered approach. Users should immediately cease all interaction with meteora.date and any associated links or wallet prompts. Wallet providers and browser extensions should be configured to block connections to newly registered domains (NRDs) with high-risk characteristics, such as those created within the last 30 days and resolving to Cloudflare IPs. Organizations should update their blocklists to include meteora.date, its resolving IP (172.67.212.202), and any related domains registered via NameSilo with similar naming patterns. For Solana ecosystem participants, enabling transaction simulation tools and verifying contract addresses through official project channels can prevent unauthorized fund transfers. Security teams should monitor for additional domains impersonating Solana or other high-value blockchain projects, particularly those using terms like 'DEX,' 'liquidity,' or 'staking' in their page titles or metadata.