meteora[.]host

Analysis of meteora.host indicates an elevated‑risk brand‑impersonation campaign targeting cryptocurrency wallets. The domain was registered on 2025‑09‑25 through NiceNIC International Group Co., Limited and resolves to 172.67.175.14, an address owned by Cloudflare, Inc. (AS13335) located in the United States. No TLS certificate is presented, and the site served the page title "Home | Meteora" before being taken offline. VirusTotal records show that three of ninety‑five scanning engines flagged the domain, and it appears on a single external blocklist.

Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. The site was listed by PhishDestroy as a blocked entity, and the identified scam type is "Wallet/Seed Phishing," suggesting attempts to harvest private keys or seed phrases. The nameservers cris.ns.cloudflare.com and sara.ns.cloudflare.com are standard Cloudflare endpoints, offering no direct attribution beyond the hosting provider.

While the brand target is listed as "across," no further detail about the specific brand or landing page content is available, and the site’s current offline status limits real‑time verification of payloads or credential‑capture mechanisms. Defenders should add 172.67.175.14 to network deny lists, enforce DNS blocking for meteora.host, and monitor Cloudflare‑hosted domains that exhibit similar registration patterns or lack of TLS. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related infrastructure, and endpoint security solutions ought to flag any attempts to submit cryptocurrency seed phrases or wallet credentials originating from this host.