megarpc[.]top

Analysis of the domain megarpc.top shows that it was registered on 26 November 2025 through NiceNIC International Group Co., Limited and is served by the name servers ns1.blnwx.com through ns4.blnwx.com. The domain resolves to the IPv4 address 45.61.136.89, which belongs to AS399629 (BL Networks) and is geolocated in the United States. An HTTP request returns a 200 OK response with the generic title “Welcome to nginx!”, indicating that the web server is presenting a default Nginx page rather than a targeted phishing landing page. The TLS certificate presented for the host is issued to “PhishDestroy / botadmin.destroy.tools”, a certificate commonly associated with malicious phishing infrastructure. MX records are configured to point to localhost with priority 0, a configuration that is atypical for legitimate mail services and may indicate a placeholder or misconfiguration used to evade detection.

VirusTotal records show that three out of ninety‑five scanning engines have flagged the domain, and the domain is currently listed on a single security blocklist. It is also actively blocked by the PhishDestroy mitigation service. The Gridinsoft trust score of zero underscores the low reputation of the hosting environment. The overall risk rating is elevated, and the domain status is reported as offline at the time of analysis.

Defenders should add megarpc.top and its resolved IP address 45.61.136.89 to network‑level deny lists, enforce DNS filtering for the domain, and monitor for any resurrection of the service. Continuous observation of the associated name servers and the AS399629 prefix is advised, as adversaries frequently reuse hosting clusters. Given the presence of a phishing‑related TLS certificate and the low trust score, any inbound traffic originating from this host should be inspected or dropped.