meteora-app[.]org

The domain meteora-app.org was registered on March 11, 2026 through Porkbun LLC and is currently hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.182.149 located in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 identifier, indicating that TLS is correctly configured despite the malicious intent. HTTP requests return a 403 status code, which may be used to obscure content from casual browsers. The authoritative name servers are evan.ns.cloudflare.com and rosemary.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The page title returned from the live endpoint reads “Meteora Ag - Advanced Solana Dex,” suggesting the site is positioned as a Solana decentralized exchange, but no further content analysis is available.

Detection infrastructure flags the domain across multiple sources. It appears on three security blocklists and has been cited in two AlienVault OTX threat pulses. VirusTotal analysis shows that two of ninety‑four security vendors have identified the domain as malicious, reinforcing the suspicion of abuse. Independent anti‑phishing tools, including PhishDestroy, MetaMask, and SEAL, have already blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100, indicating extreme risk. The campaign is categorized as wallet/seed phishing, with the threat actor impersonating “across,” a generic reference to multiple brand targets rather than a single named brand.

This suggests the site may be used to harvest cryptocurrency wallet credentials or seed phrases from unsuspecting users. Uncertainties remain regarding the exact phishing page layout, the presence of any credential‑capture forms, and the extent of victim outreach. However, the convergence of blocklist listings, low trust scoring, and the wallet‑seed phishing classification provides sufficient evidence for defensive action. Security teams should update web filtering rules to block meteora-app.