metesora[.]bar

The domain metesora.bar was registered on April 20 2026 through Namecheap and currently resolves to the Cloudflare‑owned address 188.114.97.3 located in CA. It is served behind Cloudflare using the nameservers apollo.ns.cloudflare.com and meera.ns.cloudflare.com and presents a valid TLS certificate from Let’s Encrypt (E8). An HTTP GET returns status 200 and the page title observed is "Staking | Meteora". Threat intelligence classifies the site as a high‑risk brand‑impersonation campaign targeting Google. The site is listed by three independent blocklists (PhishDestroy, MetaMask, SEAL) and appears on three security blocklists overall. VirusTotal analysis shows that 3 of 91 scanned security vendors flagged the domain as malicious. AlienVault OTX includes the domain in one pulse, and Gridinsoft assigns a trust score of 0 / 100. No additional technical artefacts such as malicious payloads or command‑and‑control endpoints have been disclosed. Because the infrastructure is fully hosted on Cloudflare, attribution is limited, but the combination of a brand‑impersonation label, low trust score, and multiple detections indicates a deliberate attempt to deceive users. Defenders should block DNS resolution for metesora.bar, monitor outbound connections to 188.114.97.3, and consider sinkholing the IP address. Continuous re‑evaluation is advised in case new indicators emerge.