meteora[.]tools

Analysis of the domain meteora.tools indicates that it was used for a wallet/seed phishing campaign targeting the brand across. The site was listed on a single security blocklist and was actively blocked by the PhishDestroy service. DNS resolution points to the IP address 104.21.43.70, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is registered through Cloudflare, Inc., and utilizes Cloudflare name servers jerry.ns.cloudflare.com and lilith.ns.cloudflare.com. No TLS certificate was observed, meaning the site operated without HTTPS protection.

The page title returned by HTTP requests is "Home | Meteora," which does not reveal any brand-specific content but confirms the site responded to basic queries before being taken offline. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal recorded a single positive detection out of 95 scanned security vendors, reinforcing the suspicion despite the low detection count. The offline status suggests the operators have either ceased activity or are rotating infrastructure.

Uncertainties remain regarding the specific phishing kit employed, the exact content delivered to victims, and any additional command-and-control endpoints that may have been used. Defenders should continue to monitor the IP address 104.21.43.70 for related activity, enforce blocklisting of meteora.tools across network filters, and update URL reputation feeds with the observed indicators. Given the lack of SSL, any attempt to access the domain would have been over cleartext HTTP, allowing network‑level inspection. Organizations should also consider tightening outbound traffic controls to Cloudflare edge nodes when no legitimate business need exists, and remain vigilant for similar wallet/seed phishing domains that impersonate across.