predeposit-megaeth[.]io

The domain predeposit-megaeth.io was registered on 25 November 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to 172.67.192.192, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are cameron.ns.cloudflare.com and eloise.ns.cloudflare.com, confirming Cloudflare as the hosting provider. No TLS certificate is presented, indicating the site is served over plain HTTP. The landing page returns the title “Nur einen Moment…”, which is German for “Just a moment…”, but no further page content has been publicly disclosed.

Gridinsoft’s trust scoring system assigns a rating of 0 out of 100, the lowest possible score, suggesting a high likelihood of malicious activity. VirusTotal analysis shows that nine out of ninety‑five scanning engines flagged the domain as malicious, and the domain is listed on a single external security blocklist. PhishDestroy has actively blocked the site, and the domain is currently reported as offline. The threat classification in the intelligence set identifies the activity as a crypto‑related scam, consistent with the generic phishing label applied by the reporting system.

The combination of a recent registration, use of Cloudflare’s edge network, lack of encryption, low trust score, and multiple vendor detections provides a strong indicator that the domain was employed for phishing or cryptocurrency theft attempts. At this time, the exact phishing kit, target brand, or victim interaction flow has not been disclosed. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any resurgence of the host IP, and add the domain to internal threat intelligence feeds. Ongoing observation of Cloudflare‑hosted IP ranges for similar low‑trust, newly‑registered domains is recommended to mitigate future campaigns that may reuse this infrastructure.