meteora[.]ink

Analysis of the domain meteora.ink confirms its classification as an active crypto drainer phishing site, targeting users with a fraudulent decentralized liquidity management interface. The domain was registered on July 7, 2026, through NAMECHEAP INC, and currently resolves to the IP address 194.31.142.219, hosted on AS398465 (Rackdog, LLC) in Germany. Infrastructure analysis reveals the use of Ubuntu and Nginx, with HSTS enabled, alongside a Let's Encrypt SSL certificate issued under the YR2 intermediate. The page title, 'Meteora DLMM AutoLP,' suggests an attempt to mimic legitimate automated liquidity provision tools, though the exact content and visual deception tactics remain unconfirmed. The domain is flagged by three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, and is classified under Google Safe Browsing's SOCIAL_ENGINEERING category. A VirusTotal scan reports detection by 4 of 91 security vendors, indicating moderate consensus on its malicious nature. The HTTP status code 307 further suggests potential redirection behavior, though the final destination is not yet analyzed. Nameservers are provided by registrar-servers.com, consistent with the domain's registration provider. Defenders should treat meteora.ink as an active threat. Network-level blocking of the IP 194.31.142.219 and domain-based filtering are recommended. Given the crypto drainer classification, users who may have interacted with the site should be advised to revoke any connected wallet permissions and monitor for unauthorized transactions. Further investigation into associated infrastructure, such as hosting provider abuse reports, is warranted to disrupt the campaign.