meteorwalletdesktop[.]com

Analysis indicates that meteorwalletdesktop.com was registered on March 19 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently offline. The domain resolves to IP 216.198.79.1, which is geolocated to the United States and associated with Lefkoff Industries. The hosting environment uses Vercel and enforces HTTP Strict Transport Security. A Let’s Encrypt certificate is present, which is typical for many legitimate sites but does not guarantee authenticity.

The page title returned from the site, “Meteor Wallet — The Most Trusted Wallet for NEAR,” suggests an attempt to impersonate a cryptocurrency wallet service for the NEAR blockchain. The domain is classified as a crypto scam and specifically as a crypto drainer, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that two out of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment. The registrar information and the use of generic nameservers ns3.my-ndns.com and ns4.my-ndns.com are consistent with other recent malicious registrations.

No additional content or page behavior has been observed because the site is taken offline, leaving uncertainty about the exact phishing vectors, credential collection methods, or smart‑contract interactions that might have been employed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP address for any re‑use, and add the domain to internal threat intel feeds. Analysts should also watch for new sub‑domains under the same registrar or similar naming patterns that could be used in future campaigns targeting NEAR wallet users. Ongoing verification of blocklist updates and periodic re‑scans of the domain when it becomes reachable are recommended to capture any changes in malicious behavior.