ww38[.]magmacapitalfinance[.]co

The domain ww38.magmacapitalfinance.co was registered on 22 January 2025 through ABOVE.COM PTY LTD and is currently hosted on the IP address 76.223.26.96, which belongs to Amazon.com, Inc. (AS16509) in the United States. DNS resolution points to nameservers ns11.abovedomains.com and ns12.abovedomains.com. No TLS certificate is presented for the host, indicating that HTTPS connections are unavailable. The page title returned by the server is "magmacapitalfinance.co," matching the primary domain name without additional branding or contextual clues.

Threat intelligence platforms have recorded the domain on a single security blocklist, and it is explicitly blocked by the PhishDestroy service. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a complete lack of confidence in its legitimacy. VirusTotal scans show that five of ninety‑five security vendors flagged the domain as malicious, reinforcing its classification as a phishing threat. The site’s current operational status is offline, which limits immediate interaction but does not eliminate the risk of future reactivation.

Observed evidence confirms the domain’s alignment with generic phishing activity, yet details about the specific payload, lure content, or targeted victim demographics remain unknown. Defenders should continue to monitor the associated IP address for any changes in service, enforce blocklisting of the domain and its IP within perimeter defenses, and incorporate the domain’s identifiers (registrar, nameservers, and IP) into threat‑intel feeds. Additionally, organizations should ensure that email filtering solutions reference the PhishDestroy blocklist and consider the zero‑trust score when evaluating inbound communications that reference magmacapitalfinance.co.