projectmagma[.]netlify[.]app

Analysis of projectmagma.netlify.app shows a confirmed phishing infrastructure that was taken offline as of the report date, July 25, 2026. The domain was created on May 09, 2018 and resolves to the IP address 98.84.224.111, which is allocated to AS14618 Amazon.com, Inc. in the United States. Hosting details reveal the site was served through Netlify, as indicated by the Netlify technology fingerprint and the presence of HTTP Strict Transport Security (HSTS) headers. The domain’s authoritative name servers are dns1.p01.nsone.net through dns4.p01.nsone.net, confirming the use of NS1 as the DNS provider.

The SSL certificate presented is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate issued by DigiCert Inc., which remains valid despite the site’s offline state. HTTP probing returned a 404 status code, indicating that the web resource is no longer accessible, yet the certificate and hosting artifacts persist. Threat intelligence sources have flagged the site: PhishDestroy listed it as blocked, VirusTotal recorded detections by three of ninety‑three security vendors, and it appears on a single security blocklist.

The page title captured during the last active probe was "Magma." No additional content analysis is available, and the exact phishing lure or credential harvesting mechanisms have not been disclosed. Defenders should immediately add projectmagma.netlify.app and its resolved IP 98.84.224.111 to outbound and inbound blocklists, monitor the NS1 name servers for any re‑registration activity, and continue to query VirusTotal and other sandbox services for potential re‑emergence. Ongoing correlation with phishing kit repositories and user‑reporting channels is recommended to detect any reuse of the domain in future campaigns.