meteorag[.]click

The domain meteorag.click was registered through Dynadot LLC on 27 February 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the Cloudflare edge address 172.67.148.103, located in the United States under ASN 13335. The authoritative nameservers are apollo.ns.cloudflare.com and meera.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was observed, so the site would have been served over plain HTTP. Threat intelligence marks the site as a Recovery Scam phishing kit.

VirusTotal reports that 2 of 93 scanning engines flagged the domain, providing limited but corroborating evidence of malicious intent. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing resource. The page title returned by the host is the domain itself, "meteorag.click", and no additional page content has been captured, leaving the exact visual payload unknown. Because the site is no longer reachable, dynamic analysis could not be performed, and the specific tactics employed by the Recovery Scam kit remain unverified for this instance. The limited detection count on VirusTotal suggests that the domain has not been widely distributed, but the presence on multiple blocklists indicates active abuse.

The use of Cloudflare’s infrastructure provides resilience and hides the true origin, a common pattern for phishing operators. Because the domain lacks an SSL certificate, any credentials submitted would have been transmitted without encryption, increasing the risk to victims. Defenders should continue to enforce blocklist policies that include the observed entries, monitor DNS queries for the domain and its Cloudflare nameservers, and consider adding the IP address 172.67.148.103 to network‑level deny lists. Ongoing vigilance is recommended in case the operator re‑hosts the kit on a different IP or re‑activates the domain.