magicad[.]org

PhishDestroy identifies magicad.org as a brand impersonation phishing domain specifically targeting the MagiCAD brand, with an elevated risk level. The domain is currently offline, having been taken down after its malicious activity was detected. This domain was created on February 24, 2026, and was registered through eNom, LLC. It resolves to IP address 35.214.214.224 and uses an SSL certificate issued by Let's Encrypt (R13). The site was flagged by 1 of 95 VirusTotal security vendors and appears on 1 security blocklist, indicating limited but confirmed malicious recognition. The page title observed was "MagiCAD Group - BIM solutions for the built environment," which mimics the legitimate MagiCAD website to deceive visitors. PhishDestroy assesses that users who may have visited the site should be cautious, as the domain could have been used to harvest credentials or distribute malware. Given its current offline status, the immediate threat is mitigated, but users are advised to monitor for any suspicious communications purporting to be from MagiCAD and to verify URLs before entering sensitive information. PhishDestroy recommends that organizations using MagiCAD products alert their employees about this impersonation attempt and reinforce best practices for identifying phishing sites, such as checking domain creation dates and SSL certificate details. The technical indicators, including the recent creation date and use of a free SSL certificate, are common traits of phishing infrastructure. Users should also consider scanning their systems for any malware if they interacted with the site while it was active.