sagamobiledao[.]com

The domain sagamobiledao.com was registered on February 21, 2026 through NameCheap, Inc. and is currently hosted on Amazon Web Services (AS16509) with the IPv4 address 216.150.1.1 located in the United States. The site resolves to a HTTP 307 redirect, indicating an intermediate forwarding step before the final payload is delivered. TLS termination is provided by a Let’s Encrypt R12 certificate, and the server advertises HTTP Strict Transport Security (HSTS), which suggests an attempt to enforce secure connections despite the phishing intent. Infrastructure analysis shows the domain is served via Vercel, a popular front‑end hosting platform, and includes Google Analytics tracking code, a pattern often observed in credential‑harvesting sites that seek to gather visitor metrics.

Email routing is configured with MX records pointing to mx1.privateemail.com and mx2.privateemail.com, both at priority 10, which may be used to receive victim communications or exfiltrate data. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming its recognition by at least one anti‑phishing community. VirusTotal reports that one out of ninety‑three scanned vendors flagged the domain, providing additional corroboration of malicious activity. The page title returned by the web server is "Saga Mobile DAO," but no further content analysis is available.

Given the combination of active hosting, a redirect response, a valid SSL certificate, and detection by multiple security sources, the domain should be treated as high‑risk. Defensive actions include adding sagamobiledao.com to network blocklists, configuring web proxies to deny HTTP 307 redirects to this host, monitoring for any outbound connections to the associated IP range, and continuing to ingest updates from PhishDestroy and other phishing intelligence feeds. Continuous re‑evaluation is advised, as the threat actor may modify the site or infrastructure in future campaigns.