event-meteora[.]xyz

The domain event-meteora.xyz was registered on May 09 2026 through Dynadot LLC. It carries a Let’s Encrypt certificate (issuer E7) issued shortly after registration, confirming rapid provisioning. The site is flagged as a high‑risk generic phishing operation and remains active as of July 12 2026.

Infrastructure analysis reveals that the domain resolves to IP 104.21.41.249, hosted by Cloudflare, Inc. in Canada. The authoritative name servers are adrian.ns.cloudflare.com and karl.ns.cloudflare.com, both belonging to the Cloudflare DNS network. An HTTP request to the root URL returns a 403 status code, suggesting the front‑end is deliberately restricting access, a common tactic for credential‑harvesting pages that serve content only after specific user interaction.

Threat intelligence sources show limited but notable detection. VirusTotal records two of ninety‑five scanning engines flagging the domain, and the site appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing its malicious reputation. The combination of a low trust score, blocklist presence, and the two vendor detections provide sufficient evidence to treat the domain as hostile despite the modest number of VirusTotal flags.

Defenders should prioritize immediate containment. Network filtering rules must block DNS resolution and HTTP(S) traffic to event-meteora.xyz and its resolved IP 104.21.41.249. Monitoring for outbound connections to Cloudflare edge nodes associated with the two listed name servers can help detect attempts to bypass static blocks. Incident response teams should also advise users to avoid any unsolicited prompts that reference the domain, as credential‑stealing pages often rely on social engineering to trigger the hidden content behind the 403 response.