megacorp[.]global

This domain, megacorp.global, is under investigation for brand impersonation phishing targeting MegaCorp, specifically its Eventide Division. The site was operational under the page title 'MegaCorp | Eventide Division' and is currently offline, though its infrastructure remains a potential vector for credential harvesting or fraudulent activity. No specific payload delivery (e.g., crypto drainers or malware) has been confirmed at this stage, but the domain’s design and branding align with classic impersonation tactics used to deceive employees or customers. Analysis indicates the domain was registered through NameCheap, Inc. on March 02, 2026, and resolved to the IP address 18.245.46.14. Despite its recent creation, the domain has already been flagged by 2 security blocklists, including PhishDestroy and OISD. VirusTotal reports 0 detections out of 95 vendors, suggesting the infrastructure has not yet been widely recognized as malicious. The SSL certificate is issued by Amazon, a common provider for both legitimate and malicious sites. Gridinsoft’s trust score for the domain is 0 out of 100, further indicating its suspicious nature. The domain is currently offline, but its registration and infrastructure remain active. Organizations are advised to monitor for reactivation or similar domains registered under the same pattern. Network defenders should add the domain and its resolved IP (18.245.46.14) to blocklists as a precautionary measure. Employees and users should be alerted to the impersonation of MegaCorp’s Eventide Division, particularly in communications requesting credentials or sensitive information. If the domain resurfaces, capture forensic artifacts such as HTTP headers, SSL certificates, and any hosted content for further analysis.