portal-megaeth[.]app

The domain portal-megaeth.app has been confirmed as a crypto drainer phishing endpoint targeting cryptocurrency wallet credentials and funds. Analysis indicates this infrastructure was designed to execute unauthorized transactions by tricking users into connecting their wallets to malicious smart contracts. The domain is currently offline, though prior activity suggests it may resurface under a different address or infrastructure. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It was registered through Dynadot LLC on December 11, 2025, and resolved to the IP address 144.31.73.129. The domain appears on two security blocklists, and Gridinsoft assigned it a trust score of 0 out of 100. The SSL certificate was issued by Hellenic Academic and Research Institutions CA, a non-standard issuer for commercial or financial services, further suggesting fraudulent intent. Technologies detected include Ubuntu, Nginx, and HTTP Strict Transport Security (HSTS), which may have been employed to lend an appearance of legitimacy. Current status indicates the domain has been taken offline, though the threat actor may attempt to re-establish operations using similar naming conventions or infrastructure. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who may have interacted with the site should immediately revoke any wallet authorizations, transfer assets to a new wallet, and scan their devices for malware. Security teams should monitor for domains with similar naming patterns (e.g., 'megaeth') and conduct retroactive log analysis to identify potential prior exposure. The use of hardware wallets and multi-signature authentication is strongly recommended for high-value cryptocurrency transactions to mitigate similar threats.