meteora-pool[.]xyz

This domain, meteora-pool.xyz, operates as a crypto drainer scam specifically designed to impersonate Meteora DLMM, a legitimate decentralized liquidity market maker protocol. The fraudulent site mimics the authentic platform's interface to deceive users into connecting their cryptocurrency wallets, subsequently executing unauthorized transactions that drain funds. The attack vector relies on social engineering tactics, such as fake yield farming promotions or liquidity mining incentives, to lure victims into interacting with malicious smart contracts. Analysis of the domain's infrastructure reveals technical indicators consistent with crypto-focused phishing operations, including the use of content delivery networks to obscure hosting origins and evade detection. Evidence supporting the malicious classification of meteora-pool.xyz includes multiple technical and reputational indicators. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with detections spanning categories such as phishing, malware, and fraudulent websites. Registered through GMO Internet, Inc. on June 01, 2026, the domain's creation date suggests a short lifespan typical of disposable phishing infrastructure. It appears on four security blocklists, further corroborating its malicious intent. The domain resolves to the IP address 188.114.97.3, which is associated with a content delivery network known for hosting both legitimate and malicious content, complicating attribution but aligning with threat actor tactics to blend in with normal traffic. Users who visited meteora-pool.xyz or interacted with its content should take immediate remedial actions to mitigate potential financial losses. First, disconnect any connected wallets from the site and revoke any suspicious smart contract approvals using a blockchain explorer or wallet management tool. Monitor wallet activity for unauthorized transactions, particularly those involving token transfers or approvals to unknown addresses. If funds were lost, report the incident to relevant blockchain analytics platforms and local cybercrime authorities to aid in tracking the stolen assets. Additionally, scan all devices used to access the domain for malware, as crypto drainers may deploy secondary payloads to maintain persistence or exfiltrate sensitive data. Exercise heightened caution with future cryptocurrency-related offers, verifying domain authenticity and contract addresses through official project channels before interaction.