magnetic-updates[.]live

Analysis of the domain magnetic-updates.live indicates active credential phishing infrastructure as of July 12, 2026. The domain was registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 104.21.52.209, hosted on Cloudflare's network in Canada. Infrastructure review shows Cloudflare nameservers (clyde.ns.cloudflare.com, maeve.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E7), which are consistent with both legitimate and malicious sites leveraging Cloudflare's proxy services. Security telemetry reveals limited but targeted detection: three of ninety-four vendors on VirusTotal flag the domain, while PhishDestroy has implemented a block. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. The observed HTTP status is 403, and the page title 'Just a moment...' suggests either a Cloudflare interstitial or a placeholder awaiting malicious content deployment. No specific brand impersonation or phishing kit has been confirmed in available data. Defenders should treat this domain as high-risk for credential harvesting. The combination of recent registration, Cloudflare proxying, and minimal but consistent detection across independent sources supports a classification of active phishing infrastructure. Network-level blocking is recommended, with monitoring for changes in HTTP response codes or page content that may indicate full operational status. Further analysis of SSL certificate patterns or historical DNS resolutions may provide additional context, though current evidence does not confirm a specific campaign target.