amagra[.]id

amagra.id is currently flagged as a generic phishing site. DNS resolution points to 172.67.211.153, an address owned by AS13335 Cloudflare, Inc., and the domain is served through Cloudflare’s network with HTTP/3 enabled. The site presents a single HTTP 301 response and advertises the page title “Amagra Production”. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint. Registration data shows the domain was provisioned via Cloudflare, Inc., and the authoritative name servers are dolly.ns.cloudflare.com and nick.ns.cloudflare.com. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. Automated scanning on VirusTotal recorded a single positive detection out of 95 scanners, and Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. No additional content analysis is available, so the precise phishing payload or target audience remains unknown. Defenders should add amagra.id to deny lists, enforce DNS‑based blocking, and monitor for any redirects or credential‑harvesting activity originating from the IP address. Continuous observation of Cloudflare‑associated IP ranges for similar indicators is advised, and any inbound traffic to the domain should be logged and investigated.