megaweb16[.]at

The domain megaweb16.at is identified as a credential harvesting phishing infrastructure targeting users of Cloudflare administrative portals. Analysis indicates the domain is currently offline, though it previously hosted a fraudulent login interface designed to capture authentication credentials. The threat type is classified as generic phishing with an elevated risk level due to its direct targeting of enterprise security tools. Infrastructure analysis reveals the domain was registered through Gransy s.r.o., a registrar associated with multiple phishing campaigns. It resolved to the IP address 188.114.97.3, a Cloudflare-protected endpoint, and employed HSTS and HTTP/3 protocols to mimic legitimate service behavior. VirusTotal telemetry shows 4 of 95 security vendors flagged the domain as malicious, while it appears on a single security blocklist. The domain was actively blocked by PhishDestroy, indicating prior detection in operational environments. Current status confirms the domain has been taken offline, though residual risk remains for organizations that failed to block the infrastructure preemptively. Defenders are advised to audit logs for connections to 188.114.97.3 or megaweb16.at, particularly from systems accessing Cloudflare services. Network-level blocking of the domain and IP is recommended, alongside user education on identifying spoofed authentication portals. Given the use of Cloudflare Browser Insights, monitoring for similar behavioral telemetry in other phishing domains may aid in detecting related threats.