meteorag[.]zone

The domain meteorag.zone was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative name servers are earl.ns.cloudflare.com and melody.ns.cloudflare.com, and the zone resolves to the IP address 188.114.96.3, which is hosted by Cloudflare in the United States (AS13335). The presence of Cloudflare’s infrastructure and the use of HTTP/3 indicate a modern, high‑performance hosting layer that is frequently leveraged by threat actors to hide origin infrastructure.

Automated reputation services have flagged the zone as malicious. VirusTotal reports 7 of 95 scanned security vendors rating the domain as unsafe, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears in a single AlienVault OTX pulse and is listed on one public blocklist. PhishDestroy has actively blocked the site, and the HTTP response returned a 403 status code with the page title "Just a moment…", a pattern commonly observed in challenge‑page redirects used by phishing infrastructure.

The TLS certificate presented by meteorag.zone is issued by Google Trust Services under the WE1 certificate profile, confirming the use of a valid, publicly trusted certificate chain. Cloudflare’s CDN and DNS services mask the true backend server, and the nameservers themselves are typical of Cloudflare‑hosted domains. No public content analysis is available; the page title provides limited insight, and the specific phishing kit or targeted brand has not been disclosed.

Defenders should add meteorag.zone to outbound and inbound blocklists, enforce DNS sinkholing, and monitor for any resolution to the 188.114.96.3 address. Network detection rules that flag HTTP/3 traffic to Cloudflare‑served domains with a 403 response and the "Just a moment…" title can help surface similar campaigns. Continuous threat‑intel feeds should be consulted for any future attribution or expansion of the campaign.