mega-accesscoin[.]com

Analysis indicates that mega-accesscoin.com was registered through Dynadot LLC on December 03, 2025 and remains active as of the report date. The domain resolves to the IPv4 address 198.23.193.170, which is assigned to AS36352 operated by HostPapa in the United States. Authoritative name servers are dns1.geebytesdns.com and dns2.geebytesdns.com, and an MX record with priority 0 points to the same domain, suggesting the attacker has configured mail services for potential credential harvesting. The web service returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (serial E8). The certificate validates the host name and provides encryption, a common tactic to increase perceived legitimacy. The page title returned by the server is “Mega-Access Coin | Home”, which does not reference the impersonated brand but confirms the site is live. No additional page content has been captured, so the exact visual or functional mimicry cannot be confirmed at this time. The domain is classified as a brand‑impersonation campaign targeting Google. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records 12 detections out of 95 scanned engines, indicating notable malicious activity. The site appears on one public security blocklist and is explicitly listed by PhishDestroy, reinforcing its malicious reputation. The combination of a recent registration, active hosting, valid TLS, and multiple security vendor flags aligns with a high‑risk profile. Defenders should add mega-accesscoin.com to URL filtering and sinkhole rules, block outbound connections to its IP range, and monitor DNS queries for the associated name servers. Email security controls should be configured to reject messages originating from the domain’s MX record. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response teams should be prepared to investigate any credential submissions that may have been directed to this infrastructure.