app[.]library[.]mmb-legacy-dev[.]magiclabs-aurora[.]io

The domain app.library.mmb-legacy-dev.magiclabs-aurora.io was registered on November 12, 2024 through Amazon Registrar, Inc. and is currently served by the four AWS name servers ns-1266.awsdns-30.org, ns-1917.awsdns-47.co.uk, ns-258.awsdns-32.com, and ns-946.awsdns. The domain resolves to the single IPv4 address 216.150.1.129, an address that is not associated with any known legitimate service and is hosted on Amazon infrastructure. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one anti‑phishing community has observed malicious activity originating from this host.

VirusTotal analysis shows that one of ninety‑one security vendors flagged the domain, providing additional corroboration of its malicious nature despite the low overall detection count. The site’s risk rating is classified as high and its status remains active as of the report date, July 27, 2026. No public SSL certificate details, HTTP response codes, page titles, or brand targeting information have been disclosed, leaving the exact content of the landing page unverified.

Nevertheless, the convergence of registration timing, AWS‑based hosting, blocklist inclusion, and the single vendor detection constitutes a strong indicator of a phishing operation. Defensive teams should add the domain and its resolving IP to network‑level deny lists, monitor outbound DNS queries for similar AWS‑hosted subdomains, and enforce strict URL filtering for any traffic to the magiclabs‑aurora.io suffix. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any escalation in detection rates, and any observed credential capture attempts should be routed to incident response for forensic analysis.