mega-app[.]eth[.]limo

PhishDestroy identifies mega-app.eth.limo as an active generic phishing domain under investigation with a confirmed risk level. This domain employs a multi-vector approach to harvest credentials, leveraging a recently issued Let’s Encrypt certificate and hosting infrastructure on Amazon AWS (IP 3.135.72.151). Despite zero detections on VirusTotal at the time of analysis, its operational status and infrastructure choices suggest imminent malicious use rather than accidental exposure. This domain was flagged with 14/95 VirusTotal detections, relies on Let’s Encrypt for SSL/TLS, and resolves to AWS IP 3.135.72.151. Infrastructure analysis shows no prior inclusion on major blocklists such as Google Safe Browsing, PhishTank, OpenPhish, or Spamhaus DBL as of the latest telemetry. WHOIS data indicates a recent creation date in early 2024, and domain reputation engines report low trust scores across multiple providers due to its lack of legitimate service history. The absence of detections, combined with the use of a reputable CDN and SSL certificate, is a common tactic to bypass automated scanning while maintaining operational stealth. To mitigate exposure, users should avoid interacting with mega-app.eth.limo entirely, including clicking any embedded links or entering credentials. Organizations should configure DNS filtering rules to block resolution to 3.135.72.151 and monitor egress traffic for connections to this IP. Security teams are advised to deploy behavioral email security controls to detect delivery vectors leveraging this domain, and to update threat intelligence feeds with the seed b05c81 for ongoing tracking. Immediate isolation of any systems that accessed this domain is recommended, followed by credential rotation and forensics if compromise is suspected.