pools[.]meteora[.]boats

This domain operates as a fraudulent staking portal targeting cryptocurrency users. Analysis indicates the site impersonates legitimate staking platforms to harvest wallet credentials and private keys, enabling unauthorized fund transfers. The page title 'Staking | Meteora' directly mimics authentic services, increasing the likelihood of user deception through familiar branding and terminology. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through Dynadot LLC, an unusually future-dated creation that aligns with known phishing campaign tactics. Security vendors flagged the domain with 2 detections out of 95 on VirusTotal, while four independent blocklists—including wallet security providers—have listed it as malicious. The site resolves to IP address 104.21.10.79, protected by Cloudflare, which is frequently exploited by threat actors to conceal server origins and evade takedowns. Users who visited pools.meteora.boats or interacted with its content should take immediate action. Disconnect any connected wallets from the site and revoke all associated smart contract approvals using a blockchain explorer. Scan the device for malware, particularly browser extensions or keyloggers that may have captured sensitive data. Monitor all linked accounts for unauthorized transactions and consider migrating funds to a new wallet if credentials were entered. Report the incident to relevant security teams and financial platforms to assist in broader fraud prevention efforts.