meteora[.]food

The domain meteora.food was registered on November 01, 2025 through Dynadot LLC and is currently listed as offline. Infrastructure analysis shows that the domain resolves to the IPv6 address 2a00:1450:4001:82b::2004, an address owned by AS15169 Google LLC and geolocated to Germany. The domain is served by Cloudflare name servers (apollo.ns.cloudflare.com and meera.ns.cloudflare.com) and does not present an SSL/TLS certificate, indicating that HTTPS connections are not secured. The site’s HTML title was observed as "Google," matching the declared brand target of Google and confirming the intent to impersonate that brand.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans recorded seven positive detections out of ninety‑five submitted security vendors, reflecting a moderate consensus among scanners that the domain is malicious. No additional public threat‑intel sources, such as OTX or Google Safe Browsing, were cited in the available data.

The limited detection footprint suggests that the campaign may have been short‑lived or that remediation actions have successfully taken the site offline. Defenders should continue to monitor the domain’s DNS records for any re‑activation, enforce corporate web‑filtering rules to block both the domain and its associated IP range, and consider adding the domain to internal blocklists if not already present. Further analysis of any captured traffic or logs from the brief active period could illuminate the specific phishing kit or payload used, but such details remain unavailable at this time.