mphengbona[.]co[.]za

This domain, mphengbona.co.za, operates as a fake login portal designed to harvest user credentials. Analysis indicates the infrastructure mimics legitimate authentication pages, tricking visitors into entering sensitive information such as usernames, passwords, or multi-factor authentication codes. The site employs a 404 Not Found page as a cloaking mechanism, likely to evade automated detection while still capturing data from unsuspecting users who reach it through deceptive links or redirects. Infrastructure analysis reveals multiple red flags confirming its malicious nature. The domain was registered on February 21, 2026, through the registrar Domains, an unusually future-dated creation that may indicate an attempt to bypass reputation-based filters. Security vendors on VirusTotal flagged it as malicious, with 16 out of 95 engines detecting it as a phishing threat. Additionally, the domain resolves to the IP address 169.239.218.62, hosted on AS327979 (DIAMATRIX C.C) in South Africa, and appears on one security blocklist. The SSL certificate, issued by Let’s Encrypt (R13), provides minimal encryption, a common tactic to lend false legitimacy to phishing sites. If you visited mphengbona.co.za or entered credentials on a page resembling this domain, immediate action is required. First, revoke any active sessions on accounts that may have been exposed and change passwords using a secure device. Enable multi-factor authentication if not already active, and monitor linked accounts for unauthorized activity. Report the incident to your organization’s security team or a trusted incident response provider. Avoid reusing passwords across platforms, and consider scanning your device for malware, as phishing sites often deploy additional payloads. If financial or sensitive data was submitted, contact relevant institutions to flag potential fraud.