780f70bf[.]magma-staging[.]pages[.]dev

This domain, 780f70bf.magma-staging.pages.dev, is flagged as a high-risk phishing site targeting users through a fake login portal. Analysis indicates the page mimics the Magma brand, presenting an interface designed to harvest credentials under the pretext of authentication. No direct evidence of a crypto drainer kit or wallet hijacking script was observed in initial scans, though the domain structure and staging subdomain suggest potential for credential theft or subsequent payload delivery. Infrastructure analysis reveals the domain resolves to IP 172.66.44.182, hosted on Cloudflare's network (AS13335). The domain was registered on February 21, 2026, through Cloudflare, Inc., and currently holds a Google Trust Services SSL certificate (WE1). VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain remains active, with no takedown or sinkholing observed. Response actions should include immediate blocking at the network perimeter and endpoint levels, particularly for organizations with ties to the Magma brand. Users who may have interacted with the site should be advised to reset credentials and monitor for unauthorized access. Despite low vendor detection rates, the staging subdomain and Cloudflare hosting pattern align with known phishing campaigns, warranting continued monitoring for evolving threats.