proelectrical[.]co[.]mz

On July 24, 2026, the domain proelectrical.co.mz was recorded as an active generic phishing site. The domain was registered on February 21, 2026 through MozDomains and is served by the authoritative name servers dns1.mzhosting.co.mz and dns2.mzhosting.co.mz. DNS resolution points to the IPv4 address 144.208.78.130, which belongs to AS54641 InMotion Hosting, Inc. and is geolocated in the United States. An HTTPS service is available; the certificate is issued by Let’s Encrypt (R13) and validates correctly, indicating the operator has obtained a free certificate for the site. The web server reports Apache HTTP Server and returns HTTP status code 200 for the root page, which carries the title “ProElectrical - Energia que Impulsiona o Desenvolvimento”.

The page title suggests the site is masquerading as a legitimate electrical services provider named ProElectrical, but no additional content has been disclosed. Security telemetry shows that two of ninety‑three VirusTotal scanners flagged the domain, and the site appears on four independent blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The risk rating assigned by the reporting platform is high, and the campaign remains active. Evidence gaps include the lack of publicly released payload samples, the exact phishing lure employed, and any credential‑stealing forms that may be hosted on the site.

Analysts cannot confirm which brand or service the page attempts to impersonate beyond the title, nor can they verify user‑impact metrics such as victim counts. Defenders should add proelectrical.co.mz to local deny lists, enforce DNS sink‑hole policies, and block outbound connections to the resolved IP address 144.208.78.130. Traffic inspection rules that detect TLS connections to the Let’s Encrypt certificate fingerprint may help catch attempts to reach the site.