airdrop[.]megaeth[.]biz[.]id

PhishDestroy identifies airdrop.megaeth.biz.id as an active brand-impersonation domain targeting Sui users. The site promotes a cryptocurrency drainer kit designed to steal wallet assets under the guise of a token airdrop. Technical analysis indicates this is a newly registered domain that has not yet been flagged by antivirus engines despite its malicious payload. Because the drainer is delivered via a spoofed Sui interface, wallet connections can result in automatic token approvals and silent transfers.

Technical indicators for airdrop.megaeth.biz.id include: VirusTotal score 0/95 detections, Let’s Encrypt SSL certificate, registration with Biz.id, resolution to IP 216.198.79.65, and current status on Google Safe Browsing (not flagged) and major blocklists (0 hits). WHOIS data shows creation on 2024-06-13, indicating a very recent campaign intended to evade legacy defenses. The IP address 216.198.79.65 has minimal reputation and hosts multiple domains linked to crypto scams within the last 30 days.

The domain remains active and under investigation. Immediate block at DNS and firewall layers is recommended. Users should verify any Sui airdrop URLs via official channels and revoke any suspicious token approvals. Because detection signatures are still low, manual blocking of the domain and IP is the most effective mitigation. Remaining risk is high until antivirus engines and blocklists catch up to this fast-moving drainer campaign.