megaeth[.]asia

Analysis indicates that the domain megaeth.asia was registered on October 28 2025 through NameSilo, LLC and resolves to the Cloudflare‑owned address 104.21.18.139 (AS13335, United States). The site is currently offline and has been taken down by the PhishDestroy takedown service. It appears on a single security blocklist and has been flagged by one of ninety‑five VirusTotal scanners, reflecting a low detection footprint but a non‑zero malicious indication. The page title retrieved from the live host reads “Vitalik’s $30M Bet: MegaETH Changes Everything and # forever! #crypto #airdrop – Jimbo's Crypto Land”, which aligns with the reported crypto‑airdrop phishing kit.

The domain is explicitly classified as a brand‑impersonation campaign targeting Facebook, employing a crypto‑scam narrative to lure victims. No TLS certificate is presented, meaning the site would serve content over plain HTTP if accessed. Nameservers betty.ns.cloudflare.com and thomas.ns.cloudflare.com confirm the use of Cloudflare DNS infrastructure. The Gridinsoft trust score of 0 / 100 further corroborates the malicious reputation.

While the offline status prevents direct content analysis, the combination of brand impersonation, a credential‑stealing airdrop kit, and the observed indicators suggests a high likelihood of credential harvesting or financial fraud. Defenders should ensure that the domain and its hosting IP are blocked at perimeter and DNS layers, add the observed nameservers to watchlists for related Cloudflare‑hosted abuse, and continue monitoring VirusTotal and other threat‑intel feeds for any re‑activation. Because the page title references a high‑profile individual and a large monetary figure, downstream phishing emails may reference these elements; security teams should update email filters to detect similar language patterns. Ongoing observation of the registrar and any future registration attempts for similar domains is recommended.