megalinesltd[.]com

Analysis of megalinesltd.com indicates a high‑risk, active phishing infrastructure. The domain was registered on 17 June 2024 through TuringSign Inc. d/b/a Cosmotown and currently resolves to the Cloudflare edge address 104.21.57.28. Nameserver records show audrey.ns.cloudflare.com and colin.ns.cloudflare.com, confirming reliance on Cloudflare’s DNS service. Threat intelligence platforms have flagged the domain: PhishDestroy lists it as blocked, and it appears on one additional security blocklist, reinforcing the perception of malicious use.

VirusTotal scans report that 4 of 91 security vendors have identified the domain as suspicious, providing independent corroboration of its phishing nature. The domain’s risk level is classified as high, and its status remains active, suggesting ongoing campaigns. While the available data confirms the phishing classification, details such as the specific lure, compromised brand, or page content have not been disclosed in the current intelligence set. Consequently, defenders lack visibility into the exact victim targeting or the credential‑harvesting mechanisms employed.

Given the confirmed indicators—registrar information, Cloudflare hosting, blocklist presence, and multi‑vendor detections—security teams should immediately block network traffic to 104.21.57.28 and add megalinesltd.com to endpoint and DNS allow‑lists. Continuous monitoring of any new detections from additional sandbox or URL‑reputation services is advised, as well as periodic re‑scans on VirusTotal to capture any changes in vendor verdicts. Organizations should also review email filtering rules for messages that reference the domain, and educate users about potential phishing attempts originating from this URL.