meteorlive[.]xyz

The domain meteorlive.xyz was observed as an active phishing infrastructure before being taken offline on 2026-07-24. Registration data shows the domain was created on 2025-09-11 through NiceNIC International Group Co., Limited, and it is delegated to the Cloudflare nameservers alex.ns.cloudflare.com and margot.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No TLS certificate is present, indicating the site operated over plain HTTP.

The page title returned by the host is the generic string “Just a moment…”, which provides no functional clue about the intended victim interaction. A security trust scoring service assigned a score of 0 out of 100, and the domain appears on a single external blocklist. VirusTotal analysis recorded five positive detections out of ninety‑five submitted scanners, confirming that multiple antivirus engines flag the domain as malicious. The underlying malicious payload has been identified as the “Airdrop Scam” phishing kit, a known template used to lure victims with fraudulent cryptocurrency airdrop offers.

The site was subsequently blocked by the PhishDestroy remediation service. Current evidence does not reveal any additional infrastructure such as secondary C2 hosts, compromised credentials, or active TLS certificates. Defenders should continue to monitor the associated IP range for any reappearance of phishing activity, enforce blocklisting of the domain and its IP in perimeter defenses, and consider adding the domain to internal threat intelligence feeds.