eligible-meteora[.]live

This domain, eligible-meteora.live, is identified as a brand impersonation threat designed to deceive users with a fraudulent airdrop scheme. The page title, 'Claim Airdrop - Meteora,' suggests an attempt to mimic the legitimate Meteora protocol, a known platform in the decentralized finance (DeFi) ecosystem. Analysis indicates no direct evidence of a crypto drainer kit, but the domain structure and content align with typical airdrop scam tactics, where victims are tricked into connecting wallets or sharing private keys under false pretenses. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.71.2, a Cloudflare-associated endpoint, which is commonly used to obfuscate malicious infrastructure. The domain is flagged by 4 out of 95 security vendors on VirusTotal, and it appears on 3 distinct security blocklists. Gridinsoft assigns it a trust score of 0/100, further confirming its malicious nature. Technologies detected include Node.js, Vue.js, Nuxt.js, and Cloudflare Browser Insights, indicating a modern, dynamic web application likely designed to evade detection and enhance user interaction. As of the latest assessment, eligible-meteora.live has been taken offline, reducing immediate exposure to potential victims. However, the domain remains a residual risk due to its recent registration and the possibility of reemergence under altered infrastructure. Response actions include blocking by MetaMask, PhishDestroy, and SEAL, which mitigates direct access but does not eliminate the underlying threat. Users are advised to verify airdrop claims through official channels only, avoid connecting wallets to unverified domains, and monitor for phishing attempts leveraging similar domain names or branding. Organizations should update blocklists to include this domain and its associated IP to prevent future access.