homeharvest[.]co[.]za

Analysis of homeharvest.co.za indicates this domain is actively associated with phishing infrastructure. Registered on April 30, 2026, through Cybersmart Ltd, the domain currently resolves to IP address 196.41.123.211, hosted in South Africa under the same provider. The site returns an HTTP 200 status but displays a '500 Internal Server Error' page title, a common tactic to mask phishing activity or mislead automated scanners. Infrastructure analysis reveals the use of Apache HTTP Server and PHP, technologies frequently exploited in credential-harvesting or malware-distribution campaigns. Security vendors have flagged the domain, with 17 out of 91 detecting it as malicious. It appears on one security blocklist and has been referenced in a threat intelligence pulse on AlienVault OTX. The domain’s trust score is 0/100, further supporting its classification as high-risk. Nameservers (ns1.mywebserver.co.za, ns2.mywebserver.co.za, ns3.mywebserver.co.za) are consistent with low-cost hosting environments often abused for phishing. The SSL certificate, issued by Let’s Encrypt (R13), is valid but does not mitigate the underlying threat, as malicious actors routinely use free certificates to appear legitimate. While the exact phishing target or lure remains unconfirmed due to the lack of visible content, the combination of a misleading error page, recent registration, and detection by multiple security vendors strongly suggests malicious intent. Defenders should treat this domain as active phishing infrastructure and consider blocking or monitoring traffic to it. Further investigation is recommended to determine if the site is part of a larger campaign or linked to other known phishing clusters.