megaehth[.]com

Analysis of megaehth.com indicates an active high‑risk phishing operation employing an Airdrop Scam kit. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare (AS13335) with the IPv4 address 104.21.57.166 located in the United States. DNS resolution points to Cloudflare nameservers joyce.ns.cloudflare.com and kirk.ns.cloudflare.com, confirming the use of Cloudflare's edge network and HTTP/3 support. The web server stack identified Node.js and Express, with HTTP Strict Transport Security (HSTS) enforced, and the TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid, publicly trusted HTTPS endpoint. HTTP requests return a 403 status code and the page title is recorded as "Blank website.

Blank site. Nothing to see here," suggesting intentional content suppression. Security telemetry shows a Gridinsoft trust score of 0 / 100 and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification. VirusTotal analysis reports eight of ninety‑three scanners flagging the domain, providing additional vendor corroboration.

While the superficial page content is empty, the presence of the Airdrop Scam kit, combined with the high‑confidence blocklist listings and multiple vendor detections, substantiates a credible phishing threat targeting cryptocurrency users. Uncertainty remains regarding the exact phishing landing pages or credential collection mechanisms, as no page content beyond the title has been captured. Defenders should block the domain at network perimeter and DNS layers, monitor outbound connections to the associated Cloudflare IP, and apply URL filtering based on the known indicator set. Continuous re‑scanning of the host and periodic review of Cloudflare‑associated subdomains are recommended to catch any future content changes or additional malicious payloads.