magiclink[.]app

The domain magiclink.app is currently flagged as a high‑risk generic phishing site. Registration data shows it was created on 18 October 2023 through Namecheap Inc., and the authoritative nameservers are ns-115.awsdns-14.com, ns-1278.awsdns-31.org, ns-1801.awsdns-33.co.uk, and ns-961.awsdns, indicating use of Amazon Route 53 DNS. DNS resolution points to the IPv4 address 76.76.21.21, which is the sole host observed for the domain. Threat intel lists the domain on one public blocklist and confirms that the anti‑phishing service PhishDestroy has already blocked it.

VirusTotal analysis reports that 2 of 91 scanned security vendors flagged the domain, confirming the presence of malicious indicators despite the low overall detection count. The domain remains active as of the latest check on 27 July 2026. No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current dataset, so the exact content and transport security posture cannot be verified. Consequently, defenders should assume the site is intended to harvest credentials or deliver further malicious payloads.

Recommended mitigation steps include adding 76.76.21.21 and magiclink.app to network‑level deny lists, updating email and web gateway filters to block the domain, and monitoring Namecheap registration feeds for any related domains created after the same date. Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any evolving payloads. Organizations should also educate end‑users about unsolicited communications that reference “magiclink” patterns, as attackers often employ such naming to increase credibility.