meteora[.]fan

This domain, meteora.fan, was identified as a wallet/seed phishing site targeting users of the Across protocol, a known cross-chain bridge platform. Analysis indicates the domain was taken offline following detection, though infrastructure details remain relevant for defenders. The domain resolved to Cloudflare IP 2606:4700:3035::ac43:be85 (AS13335, United States) and used Cloudflare nameservers (cris.ns.cloudflare.com, sara.ns.cloudflare.com), a common hosting choice for both legitimate and malicious actors. No SSL certificate was present, increasing the likelihood of interception or tampering during transmission.

The page title, 'Home | Meteora,' does not directly reference Across but aligns with the reported scam type of wallet/seed phishing, suggesting an attempt to harvest sensitive credentials or recovery phrases. Detection data shows limited but actionable coverage: three of 95 security vendors on VirusTotal flagged the domain, while PhishDestroy and at least one other security blocklist marked it as malicious. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The domain was registered through Cloudflare, Inc., which provides privacy protections that can obscure ownership details.

While the site is currently offline, defenders should monitor for re-emergence under the same or similar infrastructure, particularly Cloudflare-hosted domains with missing SSL certificates. Historical DNS records and IP associations should be cross-referenced with known Across-related phishing campaigns. Given the elevated risk level, automated blocking at the DNS or proxy level is recommended for organizations handling cryptocurrency or cross-chain assets.