vote-megaeth[.]net

This domain vote-megaeth.net is currently active and has been classified as a crypto-related phishing campaign. The domain was registered on April 12 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted behind Cloudflare, using the nameservers demi.ns.cloudflare.com and eoin.ns.cloudflare.com. DNS resolution points to IP 188.114.96.3, which belongs to Cloudflare, Inc. The site presents a page titled “Just a moment…” and returns HTTP 403, indicating that the content is being gated or blocked by Cloudflare’s security layer. The TLS certificate is issued by Let’s Encrypt (E7), and the service employs Cloudflare Browser Insights and HTTP/3. Threat intelligence sources list the site on three public blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in a single pulse, and VirusTotal reports three detections out of ninety‑four scanners. The Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The risk level is marked high and the infrastructure remains operational. Open questions include the exact phishing landing page content and the specific cryptocurrency wallets or addresses targeted, as the page has not been publicly captured. Defenders should add vote‑megaeth.net to URL filtering, blocklist, and DNS sinkhole policies, monitor for any related C2 traffic to 188.114.96.3, and enforce TLS inspection to capture the underlying payload. Continuous re‑evaluation is advised as additional indicators may emerge.