maga-voice[.]top

This domain, maga-voice.top, is flagged as a confirmed brand impersonation scam designed to deceive cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates the site mimics a political brand, leveraging high-profile branding to lure victims into interacting with malicious smart contracts or wallet-draining scripts. No explicit drainer kit signatures were identified in surface-level scans, but the use of modern JavaScript frameworks suggests dynamic payload delivery, a common tactic in crypto-focused phishing operations. Technical indicators confirm the domain was registered on March 07, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. The site resolves to the IP address 188.114.97.3, which is part of a network known for hosting phishing and scam infrastructure. VirusTotal detection metrics show 2 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. Technologies detected include Node.js, Vue.js, Nuxt.js, and Cloudflare, with HTTP/3 support, indicating a professionally developed front-end designed to evade basic detection mechanisms. The domain has not been listed in Google Safe Browsing databases at the time of analysis. As of the latest assessment, maga-voice.top has been taken offline, likely in response to detection and blocking by multiple security platforms. However, the infrastructure remains a residual risk, as threat actors may repurpose the domain or migrate to newly registered lookalike domains. Users are advised to verify airdrop legitimacy through official channels only and avoid interacting with unsolicited crypto-related promotions. Wallet addresses and smart contracts associated with this campaign should be treated as compromised and blacklisted in security tools. Continuous monitoring of registrar activity and DNS resolutions is recommended to preemptively identify related threats.