meteora[.]vin

Analysis of meteora.vin, observed as an offline site on 25 July 2026, indicates that the domain is being used for wallet/seed phishing under a brand‑impersonation campaign. The domain resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335, United States). Registration was performed through Cloudflare, Inc., and the authoritative nameservers are amalia.ns.cloudflare.com and kyree.ns.cloudflare.com, confirming that the infrastructure is fully hosted on Cloudflare’s network. No TLS certificate is presented, leaving the site accessible only via plain HTTP, which is consistent with the lack of encryption often seen in rapid‑deployment phishing domains.

Reputation signals are uniformly negative. The Gridinsoft trust score is 0 out of 100, and the domain appears on one external security blocklist. VirusTotal scans show that 2 of 95 antivirus engines flagged the domain, and it is listed by the PhishDestroy blocklist, reinforcing the malicious classification. The page title returned from the HTTP response is “Home | Meteora”, but no further content has been captured because the site was taken offline before a full scrape could be completed.

The intelligence attributes the campaign to an “across” brand target, suggesting that the phishing page may have been crafted to lure victims of multiple services rather than a single trademark. Because the site is currently offline, active traffic cannot be measured, and the exact phishing payload (e.g., wallet address, seed‑capture form) remains unknown. Defenders should continue to block the domain at perimeter devices, monitor DNS queries for the resolved IP address, and add the domain to internal blacklists. Additional investigation should focus on any recent DNS queries from internal users, correlation with known wallet‑phishing indicators, and potential reuse of the same Cloudflare‑hosted IP for future campaigns.