reg-megaetn[.]com

This domain is flagged as a confirmed crypto drainer phishing site, designed to impersonate the Mega platform and target cryptocurrency wallet credentials and digital assets. Analysis indicates a high likelihood of credential theft and unauthorized fund transfers, with infrastructure mimicking legitimate services to deceive users into connecting wallets or entering sensitive information. Infrastructure analysis reveals the domain reg-megaetn.com was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.50.23, a Cloudflare proxy commonly used to obfuscate hosting origins. The SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy. The domain appears on four security blocklists and is flagged by 2 out of 95 security vendors on VirusTotal. Additionally, it is referenced in two AlienVault OTX threat intelligence pulses and is actively blocked by multiple wallet security tools. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address across all network security controls. Users should be advised to revoke any wallet connections or credentials previously entered on this site. Organizations should monitor for unauthorized transactions linked to wallets that may have interacted with this domain. Security teams are recommended to conduct a retrospective analysis of logs for any connections to 104.21.50.23 or reg-megaetn.com, particularly from endpoints handling cryptocurrency transactions. Wallet holders should enable transaction simulation tools to preview and block malicious transactions before execution.