meteora[.]trade

The domain meteora.trade was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the IP address 104.21.48.1, which belongs to ASN 13335 operated by Cloudflare, Inc., locating the host in the United States. The site presented the page title “Claim Airdrop - Meteora”, indicating a crypto‑airdrop lure, and analysis of the supplied intelligence links the activity to the publicly available “Airdrop Scam” phishing kit. The SSL certificate presented is identified as WE1, but no further certificate details are disclosed.

Reputation checks show a Gridinsoft trust score of 0 / 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and AlienVault OTX records a single pulse referencing it. VirusTotal scans returned 12 positive detections out of 93 participating security vendors, confirming that multiple anti‑malware engines recognize the domain as malicious. The combination of a newly created domain, low trust score, Cloudflare hosting, and the presence of a crypto‑airdrop lure suggests an intent to harvest cryptocurrency credentials or private keys.

However, the exact payload, command‑and‑control infrastructure, and victim interaction flow have not been publicly released, leaving those vectors uncertain. Defenders should continue to block meteora.trade at network perimeter and DNS layers, monitor for any resurgence of the domain or its aliases, and update intrusion detection signatures to include the observed page title and associated kit markers. Ongoing threat‑intel feeds should be consulted for any new pulses or blocklist entries that reference the domain or related infrastructure.