ecosystems-megaeth[.]app

The domain ecosystems‑megaeth.app was registered on 2026‑05‑03 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the Cloudflare address 104.21.72.4 located in Canada. The site presents a valid TLS certificate issued by Let’s Encrypt (E7) and returns HTTP 200 for the page titled “Road to TGE | MegaETH”.

Infrastructure analysis shows the domain is served from Cloudflare’s network, using the authoritative name servers destiny.ns.cloudflare.com and yichun.ns.cloudflare.com. The web application stack includes Node.js running on Express, with integrations to Apple iCloud Mail, Google Sign‑in, Apple Sign‑in, Salesforce, Amazon Web Services, and Stripe, indicating an attempt to mimic legitimate financial and identity services.

Threat intelligence classifies the site as a generic phishing campaign targeting cryptocurrency investors. VirusTotal records a single positive detection out of 95 scanned vendors, while Gridinsoft assigns a trust score of 0 / 100. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming its malicious reputation despite the low vendor‑level detection count.

Defenders should add ecosystems‑megaeth.app and its resolved IP 104.21.72.4 to URL filtering and network‑level deny lists. Monitoring of DNS queries for the associated Cloudflare name servers can provide early warning of related infrastructure reuse. Given the presence of legitimate‑looking sign‑in services, endpoint controls that validate the authenticity of OAuth flows and payment redirects are advised. Continuous re‑evaluation of the domain’s status is recommended, as the low detection count does not preclude rapid escalation.