bridge-megaeth[.]app

Analysis of bridge-megaeth.app shows that the domain is currently taken offline but historical indicators point to a wallet/seed phishing campaign targeting Ethereum users. The domain resolves to IP address 104.21.80.201, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Both authoritative nameservers, cameron.ns.cloudflare.com and eloise.ns.cloudflare.com, are hosted by Cloudflare, confirming that the operator relied on the provider’s CDN and DNS services. Registration information lists Cloudflare, Inc. as the registrar, and no SSL certificate was observed for the site, which is consistent with a rapid‑deployment phishing kit that often forgoes HTTPS.

Google Safe Browsing has flagged the domain for social engineering, and the site appears on a single security blocklist. PhishDestroy also lists the domain as blocked, and VirusTotal reports that four out of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious intent. The page title retrieved, “MegaETH | Public Sale,” combined with the declared brand target of Ethereum, aligns with a wallet/seed phishing narrative that attempts to lure victims into submitting private keys or seed phrases. Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of credibility.

The elevated risk rating reflects the convergence of these indicators. Defenders should add bridge-megaeth.app to DNS and URL filtering policies, monitor for any re‑appearance of the domain or related subdomains, and consider blocking the associated Cloudflare IP range if broader mitigation is required. Continuous observation of Cloudflare‑hosted phishing infrastructure is advised, as the provider is frequently abused for similar campaigns. Since the site is offline, immediate incident response is not needed, but threat‑intel feeds should be updated to include the domain and its associated indicators for future correlation.