beninmaritime[.]org

The domain beninmaritime.org is currently flagged as a high‑risk generic phishing infrastructure. Registration data shows the domain was created through Web Commerce Communications Limited dba WebNic.cc, a registrar known for bulk registrations. DNS resolution points to IP address 31.7.65.231, which is hosted by Asiatech Data Transmission in Iran and served by the nameservers irns1.netafraz.com and irns2.netafraz.com. The site presents an HTTP 301 redirect and is protected by a Let’s Encrypt R12 certificate, a common choice for malicious operators seeking valid‑looking TLS. Email services are indicated by an MX record for mail.beninmaritime.org (priority 10), suggesting the domain may be used for credential‑stealing or spoofed communications. Threat‑intel feeds corroborate the malicious profile: the domain appears on one security blocklist, is listed in four AlienVault OTX pulses, and has been blocked by the PhishDestroy sinkhole. VirusTotal analysis reports detections by seven of ninety‑one scanners, reinforcing the suspicion of phishing payloads. While the exact phishing lure (e.g., login clone, invoice bait) has not been publicly disclosed, the convergence of registration, hosting, TLS, and detection data indicates an active phishing operation. Defenders should block network resolution to 31.7.65.231, deny SMTP traffic to mail.beninmaritime.org, and add the domain to URL filtering rules. Continuous monitoring of the associated IP and any future VT scans is recommended to capture evolving payloads.