rahti-shop[.]ma

The domain rahti-shop.ma was registered on February 21, 2026 through the CAP CONNECT registrar and is delegated to the nameservers ns1.osmev.com and ns2.osmev.com. DNS resolution points to the IP address 38.19.202.28, which is announced by AS9186 ONITELECOM – INFOCOMUNICACOES, S.A. in Portugal. The host currently returns a HTTP 404 Not Found page title and presents no TLS certificate, indicating that any attempted credential capture would have occurred over unencrypted HTTP. The site has been taken offline, but historical evidence shows it was active long enough to be indexed by multiple security services.

Detection metrics show that 16 of 93 VirusTotal scanners flagged the domain, and AlienVault OTX includes it in a single threat‑intelligence pulse. The domain appears on one public blocklist and is explicitly blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. Risk is rated elevated, and the current status is offline, limiting further content analysis.

Uncertainty remains around the exact phishing payload or credential‑harvesting page because the live site is no longer reachable and no SSL or page‑content details are available. Defenders should continue to block the domain and its associated IP address at perimeter and DNS layers, add the host to internal blocklists, and monitor the IP range for re‑use. Re‑enabling TLS enforcement and strict HTTPS‑only policies can mitigate any future attempts to host similar content on the same infrastructure. Ongoing threat‑intel feeds, especially OTX and VirusTotal updates, should be consulted for any re‑appearance of the domain or related indicators.