mail12[.]goteal[.]io

The domain mail12.goteal.io was observed hosting a credential phishing site and is currently taken offline. DNS resolution points to the IPv4 address 52.44.87.47, which belongs to an Amazon Web Services EC2 instance in the us-east-1 region of the United States. The authoritative name servers are pdns03.domaincontrol.com and pdns04.domaincontrol.com, indicating registration through GoDaddy.com, LLC. The SSL certificate presented by the server is issued by Amazon, a standard certificate for AWS‑hosted services, and does not provide any additional trust signals beyond the hosting provider. HTTP requests to the domain return a status indicating the site has been removed from service, consistent with the reported offline state.

Security‑vendor analysis on VirusTotal shows that 17 of 94 scanners flagged the domain as malicious, reflecting a moderate consensus among AV engines that the site was engaged in phishing activity. The domain appears on a single public blocklist and has been added to the PhishDestroy blocklist, confirming that at least one dedicated anti‑phishing service has cataloged the infrastructure. No Safe Browsing, OTX, or additional reputation scores were identified in the available intelligence.

The page title returned by the server is the literal domain name, mail12.goteal.io, offering no further clues about the targeted brand or service. The only classification provided is "Credential Phishing," indicating that the site was likely used to harvest user credentials, though the specific victim brand or login portal has not been disclosed. Registration data shows the domain was created on 28 June 2016, suggesting the actor may have repurposed an older registration for this campaign.

Defenders should block outbound connections to 52.44.87.47 and add mail12.goteal.io to internal URL filtering lists. Email security gateways should be updated to flag any messages containing links to this domain, even though the site is offline, to prevent future reuse.