bafybeidgsjkjmydcyqrmho4tx2fp7rf346ii4hkxr7ct2clew6d6iymuku[.]ipfs[.]dweb[.]link

This domain, hosted on the InterPlanetary File System (IPFS) gateway dweb.link, impersonates MegaETH under the pretext of a "Road to TGE" (Token Generation Event) campaign. The site is designed to deploy crypto drainer malware, a type of malicious software that automatically siphons cryptocurrency from connected wallets without user consent. Victims are typically lured through social engineering tactics, such as fake airdrop announcements or exclusive token sale offers, and prompted to connect their wallets to the fraudulent site. Once connected, the drainer executes unauthorized transactions, transferring assets to attacker-controlled wallets. This threat specifically targets users anticipating MegaETH’s token launch, exploiting the brand’s credibility and the high interest in early investment opportunities. Analysis indicates this infrastructure is highly suspicious and likely malicious. The domain, registered through CSC Corporate Domains, Inc., was created on April 30, 2026, an anomalous future date that suggests domain spoofing or a placeholder entry in registration records. At the time of detection, the domain resolved to the IP address 209.94.90.3 and used a Let’s Encrypt SSL certificate, a common tactic to appear legitimate. Security vendors on VirusTotal flagged the domain as malicious, with 16 out of 95 engines detecting it as a threat. Additionally, the domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and has been assigned a trust score of 0/100 by Gridinsoft. Technical indicators reveal the use of Cloudflare and HTTP/3, which may be employed to obfuscate the true origin of the attack and evade detection. Users who visited this domain or connected a wallet to it should assume their cryptocurrency assets are at risk. Immediate action is required: disconnect the wallet from all dApps, revoke any suspicious smart contract approvals, and transfer remaining funds to a new, secure wallet. Monitor transaction history for unauthorized transfers and report any losses to the relevant blockchain explorer or wallet provider. To prevent future exposure, enable transaction simulation tools that preview wallet interactions before execution. Avoid engaging with unsolicited token sale or airdrop promotions, particularly those hosted on decentralized storage networks like IPFS, which lack centralized oversight and are frequently abused for phishing. Verify all communications through official MegaETH channels, and treat any domain claiming affiliation with an upcoming token launch as suspicious unless explicitly confirmed by the project’s verified sources.