meteora[.]onl

The domain meteora.onl was registered on September 25, 2025 through NameSilo, LLC and is delegated to the Cloudflare name servers jerry.ns.cloudflare.com and lilith.ns.cloudflare.com. DNS resolution points to the IP address 172.67.140.222, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented for the site, indicating that HTTPS was not configured at the time of observation. The only visible page element is the HTML title tag "Home | Meteora," which does not reveal any additional branding or functional cues.

The domain is listed on a single security blocklist and has been flagged by one of ninety‑five antivirus engines on VirusTotal, demonstrating limited but non‑trivial detection coverage. Independent reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain is actively blocked by the PhishDestroy sinkhole, confirming its classification as malicious infrastructure. According to the supplied intelligence, the site was used for a wallet/seed phishing campaign that targets users of the "across" brand, though the exact phishing page content has not been captured.

As of the report date, July 25, 2026, the domain is reported offline, but the underlying Cloudflare hosting can be re‑activated quickly, so the threat may resurface. Defenders should add meteora.onl to outbound and inbound blocklists, monitor for new domains resolving to the same Cloudflare IP range, and enforce strict validation of wallet seed inputs across affected applications. Continuous threat‑intel feed updates are recommended to capture any re‑registration or reuse of the domain or its associated infrastructure.