megaeth[.]onl

Analysis of megaeth.onl indicates a recent brand impersonation campaign targeting Google users. The domain was registered through Dynadot LLC and created on November 17, 2025. DNS resolution points to IP address 142.250.185.132, which belongs to AS15169 Google LLC and is physically located in the United States. Despite the legitimate‑looking IP, the domain is not associated with any authorized Google service; instead, it appears to be an attempt to leverage Google's brand reputation. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming that the domain is fronted by Cloudflare’s network and supports HTTP/3.

A TLS certificate issued by Google Trust Services under the WE1 profile is present, further mimicking authentic Google infrastructure. The HTTP response returned a 404 status code, and the page title reported by the scanner is simply "Google," providing no additional content for assessment. VirusTotal scanned the domain and recorded 2 detections out of 95 security vendors, indicating that at least a small subset of scanners flagged it as malicious. The domain is listed on one public blocklist and has been explicitly blocked by the PhishDestroy service. Current monitoring shows the domain has been taken offline, but its recent activity suggests it may be re‑activated in future campaigns.

Defenders should continue to block the domain at network perimeter devices, add the domain to threat intelligence feeds, and monitor the associated IP range for any re‑use. Given the use of a legitimate Google‑issued certificate and hosting on a reputable CDN, additional verification steps such as DNS‑based authentication checks (e.g., DMARC, SPF) on any outbound traffic claiming to originate from this domain are advisable. Organizations should also educate users that a simple page title of "Google" does not guarantee authenticity, especially when accessed via an unexpected URL.