app-magmafinance[.]com

This domain is flagged as a high-risk credential harvesting phishing site targeting financial service users. Analysis indicates the infrastructure is designed to mimic legitimate platforms, likely to capture sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The domain poses an immediate threat to individuals and organizations interacting with financial or cryptocurrency-related services, where stolen credentials could lead to unauthorized account access and financial loss. Infrastructure analysis reveals the domain app-magmafinance.com was registered on December 16, 2025, through MAT BAO CORPORATION, a registrar historically associated with malicious domain registrations. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network frequently exploited to conceal phishing infrastructure. The domain is detected by 18 out of 95 security vendors on VirusTotal, with a page title of 'Magma,' suggesting an attempt to impersonate a legitimate financial platform. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by Google Safe Browsing for phishing. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security to potential victims. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.97.3) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection, email filtering, and web gateways to prevent user access. Organizations are advised to monitor for authentication attempts originating from this domain, particularly those involving financial or cryptocurrency-related services. User awareness training should emphasize verifying domain authenticity before entering credentials, especially for platforms mimicking financial services. Incident response teams should investigate any prior interactions with this domain to assess potential credential exposure and enforce password resets for affected accounts.