votes-megaeth[.]com

votes-megaeth.com was registered on May 01 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain uses Cloudflare’s authoritative name servers aria.ns.cloudflare.com and derek.ns.cloudflare.com, and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. in Canada. The site presents a valid Let’s Encrypt certificate (E8) but returns HTTP 403 for direct requests, a pattern commonly observed in credential‑harvesting pages that hide content behind a denial response. Infrastructure analysis shows the domain is already listed on four public blocklists and has been flagged by multiple commercial block‑list engines including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The same IP address appears in a single AlienVault OTX pulse, indicating prior correlation with malicious activity. VirusTotal scans have resulted in five out of ninety‑five security vendors labeling the domain as malicious, while Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the suspicion of a low‑reputation host. Threat intelligence indicates the domain is being used for a generic phishing campaign, likely targeting users seeking voting or cryptocurrency services, as suggested by the “megaeth” component of the name. The high‑risk rating and active status reflect ongoing exploitation. However, the exact phishing kit, lure content, or affected brand has not been disclosed in the available data, leaving the precise social‑engineering vector uncertain. Defenders should immediately block both the domain and its underlying IP address at perimeter and DNS layers. Continuous monitoring of DNS queries for the Cloudflare name servers is advised, as the attacker may switch to additional IPs behind the same CDN. Incident response teams should also capture any HTTP 403 responses for forensic analysis, and update endpoint security solutions with the latest IoC hashes derived from the five VirusTotal detections.