megatroxi[.]com

The domain megatroxi.com was a phishing site engaged in brand impersonation targeting Google. It presented itself as a legitimate Google service to deceive users into disclosing login credentials or other sensitive information. No crypto drainer kit was associated with this campaign. The site is currently taken offline, reducing immediate risk to users.

Technical indicators confirm the elevated risk level. megatroxi.com was flagged by 3 of 95 security vendors on VirusTotal, including alphaMountain.ai and Fortinet. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered on July 22, 2025, through DEVEXPANSE LTD d/b/a Regery.com and resolved to the IP address 107.172.61.186, hosted on AS36352 (HostPapa) in the US. No SSL certificate was issued for the domain, and the observed page title was 'megatroxi.com'. Nameservers were limited to 1, a common trait in short-lived phishing infrastructure.

Users who interacted with megatroxi.com should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s abuse form and to platforms like PhishTank or the Anti-Phishing Working Group to aid in broader takedown efforts.