meteora[.]to

Analysis of the domain meteora.to, created on August 24 2025 and currently taken offline, indicates it was used for a wallet/seed phishing campaign targeting users of the Jito platform. The site was registered through Spaceship, Inc. and points to the IPv6 address 2606:4700:3037::6815:5475, which belongs to AS13335 operated by Cloudflare, Inc., locating the hosting infrastructure in the United States. DNS resolution is handled by the Cloudflare‑provided nameservers cheryl.ns.cloudflare.com and jaxson.ns.cloudflare.com. No TLS certificate was observed for the host, meaning connections would have been served over plain HTTP.

The page title returned by the server was “Home | Meteora”, which does not directly reference the impersonated brand. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has reported the site as blocked, and VirusTotal scanned the domain with 95 antivirus engines, none of which flagged it; however, the lack of detections alone does not guarantee the domain is benign.

The evidence points to a deliberate attempt to harvest cryptocurrency wallet seeds by masquerading as a Jito‑related service, though the exact phishing kit or page content has not been disclosed. Defenders should continue to monitor for any re‑appearance of the domain or related infrastructure, add the IPv6 address and the domain to blocklists, and educate Jito users about unsolicited requests for seed phrases. Because the domain is offline, immediate takedown is not possible, but threat‑intel sharing with partners and updating detection rules for the “Home | Meteora” title pattern are recommended.