meteoraairdrop[.]xyz

The domain meteoraairdrop.xyz has been identified as a brand impersonation threat specifically targeting users of the Across protocol. This infrastructure was designed to mimic a legitimate token airdrop, presenting itself as a "Meteora Airdrop" for MET tokens. Analysis confirms the domain is currently offline, though prior activity indicates malicious intent to deceive users into interacting with fraudulent smart contracts or wallet-draining mechanisms. Infrastructure analysis reveals the domain was registered through Ultahost, Inc. on October 14, 2025, and resolved to the IP address 45.12.2.67. Security vendor detection on VirusTotal shows 4 of 95 engines flagged the domain as malicious. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. The page title, "Meteora Airdrop | Claim Your MET Tokens," directly impersonates Across protocol branding to exploit user trust in token distribution events. Given the domain's current offline status, no active threat is present; however, users who may have interacted with it should revoke any connected wallet permissions immediately. Organizations are advised to monitor for resurgence of similar infrastructure, particularly domains mimicking token airdrops or governance events. Network defenders should block the resolved IP (45.12.2.67) and implement detection rules for domains registered through the identified registrar with similar naming patterns.