Protocol-impersonator domain registered (typosquat)
Meteora's assessment for RD-F-161 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Cat 11 threat intelligence signal. Multiple confirmed Meteora-brand typosquat/phishing domains registered within the 90-day assessment window: (1) meteora-ag.org — registered 2026-02-21 via Dynadot LLC (84 days before 2026-05-16 assessment; within 90-day window); flagged by 5 security vendors; listed on PhishDestroy, MetaMask, and SEAL blocklists; confirmed malicious by PhishDestroy investigation. (2) ag.meteora.gifts — registered 2026-02-21 (same day as meteora-ag.org; 84 days; within 90-day window); confirmed phishing by PhishDestroy. The coordinated same-day registration (2026-02-21) of meteora-ag.org and ag.meteora.gifts suggests an organized phishing campaign, not opportunistic individual registration. Additional domains: meteora.to (registered 2025-08-24, 265 days ago; outside 90-day window but still partially active); meteora.tools (flagged 2026-04-27 by 1 vendor; registration date unknown but flagging is within window). Registration-date-to-assessment-date delta for primary dom
Sources #
- URLmeteora-ag.org Investigation — Phishing DetectedPhishDestroy meteora-ag.org: registered 2026-02-21 via Dynadot LLC; first detected 2026-02-26; flagged by 5 security vendors including PhishDestroy/MetaMask/SEAL; confirmed malicious; 84-day delta to 2026-05-16 assessmentretrieved 2026-05-16
- meteora.to — Is this a phishing threat?PhishDestroy meteora.to: registered 2025-08-24; HIGH risk classification; HTTP 530; 0/95 VirusTotal detections despite malicious classification; listed in 1 public blocklistretrieved 2026-05-16
- Fake Meteora Website Scam — Removal and Recovery StepsPCRisk Fake Meteora Website Scam guide: documents active phishing campaigns including fake Meteora sites; confirms active user-facing threat ecosystemretrieved 2026-05-16
Methodology #
Determine whether a typosquat of the official protocol domain has been registered in the last 90 days.
See the full factor methodology and distribution across all protocols →