sergheymagala[.]net

Analysis of sergheymagala.net confirms its classification as an active credential phishing site. The domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu and currently resolves to IP address 35.214.176.12, hosted on Google LLC infrastructure (AS19527) in the Netherlands. The site returns an HTTP 202 status, which may indicate an attempt to evade automated detection or simulate a legitimate service in an intermediate state. The page title, 'Home - Serghey Magalà,' does not explicitly reveal the targeted brand or service, though the inclusion of a personal name may suggest an attempt to impersonate an individual or entity for social engineering purposes. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and Nginx, hosted on SiteGround with nameservers ns1.siteground.net and ns2.siteground.net.

The presence of jQuery Migrate and YouTube embeds may be leveraged to enhance legitimacy or deliver malicious payloads. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its accessibility and automation. Detection data indicates low but consistent suspicion: Gridinsoft assigns a trust score of 15/100, and the domain appears on one security blocklist (PhishDestroy). One of 93 security vendors on VirusTotal flags the domain as malicious, though the specific nature of the threat remains unconfirmed without further sandbox analysis. The domain remains active as of July 25, 2026.

Defenders should treat this domain as high-risk for credential harvesting or personal data theft. Recommended actions include blocking the domain and IP at the network perimeter, monitoring for connections to 35.214.176.12, and alerting users to avoid interaction. Further investigation into the WordPress instance may reveal additional indicators, such as plugin vulnerabilities or malicious JavaScript.