app-meteora-ag[.]run

app-meteora-ag.run is currently active and serves HTTP 200 content under the page title "Meteora Tours with Dayna Stewart | Authentic Greek Adventures". The site is protected by a Google Trust Services certificate issued to "WE1", and its front‑end is delivered through Cloudflare with HTTP/3 support. DNS resolution points to 172.67.206.169, an IP owned by Cloudflare (AS13335) located in the United States. The domain was registered via Porkbun LLC and uses the Cloudflare authoritative name servers colin.ns.cloudflare.com and addilyn.ns.cloudflare.com. VirusTotal analysis shows that 2 of 95 scanned security vendors flagged the domain, and it appears on one external blocklist, where it is already listed by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious use. The classification provided is generic phishing with a high risk rating. No additional content analysis is available beyond the page title; the exact phishing payload or credential‑capture mechanisms have not been observed. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the associated Cloudflare IP, and consider adding the domain to internal blocklists. Ongoing surveillance is advised to detect any changes in content or additional infrastructure, as the current evidence suggests an active phishing campaign targeting users interested in Greek travel services.