megaphone[.]xyz

This domain is flagged as an elevated-risk phishing site specifically designed to impersonate a cryptocurrency campaign under the guise of 'Megaphone | Crypto Campaign'. Analysis indicates the site was engineered to harvest credentials, private keys, or financial details from users under false pretenses, leveraging social engineering tactics common in crypto-related fraud schemes.

Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain, registered through Go Daddy, LLC on February 21, 2026, resolves to the IP address 104.26.3.84 and is protected by Cloudflare, a technique frequently employed to obscure malicious infrastructure. It appears on one security blocklist and is blocked by PhishDestroy, while VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious. The site employed Google Trust Services for SSL certification, Google Analytics for tracking, and HSTS for enforced encryption—all legitimate technologies repurposed to lend credibility to the fraudulent operation. The Gridinsoft trust score of 0/100 further corroborates its malicious classification.

To mitigate exposure, organizations and individuals should immediately block the domain megaphone.xyz and its associated IP 104.26.3.84 at the network perimeter. Endpoint protection systems should be updated to include this domain in real-time phishing filters. Users who interacted with the site should assume credential compromise and revoke access to any linked crypto wallets or accounts. Security teams are advised to monitor for lateral movement or follow-on attacks, particularly those involving cryptocurrency transactions or requests for private key disclosures. Given the use of Cloudflare, additional scrutiny should be applied to other domains resolving to the same IP range, as this infrastructure may be reused across multiple phishing campaigns.