mail[.]pwallsolutions[.]co[.]za

PhishDestroy’s investigation into mail.pwallsolutions.co.za identifies it as a generic phishing domain, currently taken offline. The domain, registered through Afrihost, was created on May 15, 2019, and its page title reads “Permanent Wall Solutions – Air Conditioning”. Despite the seemingly legitimate title, the domain has been flagged by 13 of 95 VirusTotal vendors and appears on 2 security blocklists. It resolves to IP address 154.0.174.58 and uses an SSL certificate from Let’s Encrypt (R12), which may lend a false sense of security to unsuspecting visitors. The domain’s age, over five years, is atypical for phishing campaigns, suggesting it may have been compromised or repurposed for malicious activity. The elevated risk level stems from the widespread vendor flags and inclusion on blocklists, indicating confirmed malicious behavior. With the domain now offline, the immediate threat is mitigated, but users should remain vigilant. PhishDestroy recommends checking for any accounts or data that may have been exposed to this domain, monitoring for phishing emails originating from it, and ensuring that security software is updated to block related domains. Additionally, organizations should educate users about generic phishing tactics that leverage seemingly innocuous page titles and legitimate-looking certificates. Past interactions with mail.pwallsolutions.co.za should be investigated for signs of credential theft or malware delivery.