meteorshop[.]biz

This domain is flagged as a credential harvesting phishing site targeting users through deceptive CAPTCHA verification pages. Analysis indicates an elevated risk level due to its active use in stealing login credentials, payment details, or other sensitive information under false pretenses. The page title, 'Вы не робот?' (translated: 'Are you not a robot?'), suggests an attempt to impersonate legitimate security checks to lower user vigilance. Infrastructure analysis reveals the domain meteorshop.biz was registered on May 31, 2021, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 91.206.71.128, a host with known associations to malicious activity. Security vendors on VirusTotal flagged the domain at a rate of 4/95, while Gridinsoft assigned a trust score of 0/100. The domain appears on two security blocklists, including PhishDestroy and OISD, and is currently offline. Detected technologies include Cloudflare, which may have been used to obfuscate the true origin of the phishing infrastructure. Mitigation against credential harvesting phishing sites like meteorshop.biz involves several technical and procedural controls. Network-level protections should include blocking the domain and its associated IP (91.206.71.128) at firewalls and DNS resolvers. Endpoint security solutions should be configured to detect and block access to known phishing domains, particularly those using deceptive CAPTCHA or verification pages. User awareness training should emphasize the risks of entering credentials on unfamiliar sites, even if they appear to mimic legitimate security checks. Organizations should also monitor for indicators of compromise, such as unexpected login attempts or unauthorized access to accounts, following exposure to such domains.