magcieden[.]app

The domain magcieden.app was registered on February 6, 2026 through Dynadot LLC and resolves to the IPv4 address 130.12.180.128. Its authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net. As of the report date, July 27, 2026, the domain remains active and is listed on three public security blocklists. Independent analysis platforms have flagged the domain, with fifteen of ninety‑one VirusTotal scanners marking it as malicious.

Additional protective services, including PhishDestroy, MetaMask, and SEAL, have already blocked access to the site, indicating that multiple threat‑intelligence feeds consider it hostile. The limited public data does not reveal a specific brand or page title being spoofed, and no SSL certificate details, HTTP response codes, or content snapshots have been released. Consequently, the exact phishing lure employed by the site cannot be confirmed at this time.

Defenders should continue to enforce network‑level blocks for the IP 130.12.180.128 and the domain itself, update URL filtering rules to include magcieden.app, and monitor DNS queries for the associated nameservers. Security teams are advised to treat any traffic to the domain as potentially malicious, isolate affected endpoints, and conduct forensic analysis on any credential submissions that may have been captured. Ongoing observation of threat‑intel feeds is recommended to capture any emerging indicators that could clarify the phishing campaign’s target or payload.