meteora-updates[.]org

Analysis of meteora-updates.org shows a newly created domain that is actively being used for credential phishing. The domain registration occurred on August 03, 2026 through DYNADOT LLC, and the authoritative nameservers listed are lunar.dns-parking.com and solar.dns-parking.com. DNS resolution points to the IP address 2.57.91.190, which remains active as of the assessment date. Google Safe Browsing classifies the site under the "social engineering" category, indicating that the URL is flagged for phishing‑related activity.

Independent blocklist monitoring confirms the domain’s presence on three security blocklists, and it has been specifically blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the high‑risk assessment. VirusTotal has processed the domain with 91 scanning engines; at the time of analysis none reported a detection, though the absence of a detection does not constitute a safety guarantee. The combined evidence—registration timing, DNS infrastructure, safe‑browsing flag, blocklist listings, and multiple security vendor blocks—demonstrates a concerted phishing campaign targeting credentials. Uncertainties remain regarding the exact phishing kit employed, the target brand or service being impersonated, and the content served when the site is accessed, as no page title or content analysis is available.

Defenders should add meteora-updates.org to internal block and allow lists, enforce URL filtering to block access, and monitor outbound authentication attempts for anomalies. Incident response teams should also trace any observed traffic to the IP 2.57.91.190, correlate with authentication logs, and consider tightening MFA enforcement for accounts that may be targeted. Continuous re‑evaluation is advised, as the infrastructure could evolve or expand to additional domains or IPs.