phase2-meteora[.]app

Analysis of phase2-meteora.app indicates that the domain was actively used for phishing before being taken offline. The domain resolves to the Cloudflare address 172.67.180.109, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. Registration was performed through Cloudflare, Inc., and the authoritative nameservers listed are dean.ns.cloudflare.com and lola.ns.cloudflare.com, both standard Cloudflare DNS services. No TLS certificate is present on the host, meaning the site operated over plain HTTP only, a common characteristic of malicious drop sites that avoid the overhead of certificate management.

The site has been blocked by PhishDestroy and appears on a single external security blocklist, reinforcing the classification as malicious. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, indicating an absence of legitimate activity. VirusTotal records show that 12 of 95 scanning engines flagged the domain as malicious, providing independent corroboration of its threat status.

The current offline status prevents real‑time verification of content, page title, or specific phishing kit details; therefore the exact lure, targeted brand, or credential‑harvesting technique remains unknown. Defenders should continue to block the domain at the network perimeter, add it to DNS sinkhole lists, and update proxy and endpoint security policies to drop any traffic to the associated IP address. Continuous monitoring of Cloudflare‑assigned IP ranges for re‑use of the same host and periodic re‑scans of the domain, should it become active again, are advisable to maintain coverage against potential resurgence.