marumomodipadi[.]co[.]za

The domain marumomodipadi.co.za has been identified as a phishing site specifically targeting users of Moila Email Hosting services. Analysis indicates the site is designed to harvest login credentials by mimicking the legitimate Moila Email Hosting platform, as evidenced by its page title 'Me @ Moila Email Hosting -Secured Professional E-mail Hosting.' The domain is currently offline but was previously active in fraudulent credential collection operations. Infrastructure analysis reveals the domain was registered through Domains on February 21, 2026, an unusually future-dated creation that may indicate fraudulent registration practices. It resolves to IP address 136.0.111.187, hosted on AS40676 (Psychz Networks) in the United States. Security validation shows the domain is flagged by 18 of 95 VirusTotal vendors, appears on one security blocklist, and was previously blocked by PhishDestroy. The site employed a Let's Encrypt SSL certificate (R13), a common tactic to lend false legitimacy to phishing pages. While currently offline, the domain's infrastructure and historical activity present ongoing risks. Organizations should maintain blocklist entries for 136.0.111.187 and marumomodipadi.co.za in network security controls. Users who may have interacted with the site should immediately reset credentials, particularly for email services. Security teams are advised to monitor for similar domains registered through Domains or hosted on AS40676, as these indicators may suggest related phishing campaigns.