rtranstics[.]co[.]za

The domain rtranstics.co.za was registered on 21 May 2026 and hosts a website titled “R Transtics - Logistic & Transport Service”. The site returns an HTTP 301 redirect and presents a Let’s Encrypt certificate issued under the R12 identifier, indicating a recent TLS deployment. The page title mimics a legitimate logistics provider, a common tactic to lure credential‑stealing victims.

Network analysis shows the domain resolves to the IPv4 address 169.239.217.23, which is hosted in South Africa at the DiaMatrix Teraco facility. The domain’s mail exchanger is mx1.cpmx.co.za (priority 10), a legitimate‑looking MX record that can be abused for phishing‑related communications. VirusTotal scans have flagged the domain on 15 of 95 security vendors, and the site appears on one external blocklist, confirming that security vendors have observed malicious activity.

Risk scoring aligns with a high‑risk classification: Gridinsoft assigns a trust score of 0 out of 100, and the domain is actively listed by PhishDestroy as a phishing source. The combination of a recent registration, low trust score, multiple vendor detections, and an IP hosted in a data center commonly used for malicious campaigns supports the conclusion that rtranstics.co.za is being leveraged for credential‑harvesting or credential‑relay operations targeting users of logistics services.

Defenders should add rtranstics.co.za to block lists at DNS and proxy layers, and consider blocking the associated IP address 169.239.217.23. Monitoring of MX traffic to mx1.cpmx.co.za for anomalous outbound mail may reveal compromised accounts. Continuous re‑inspection of the domain’s TLS certificate and periodic VirusTotal rescans are advised to detect any changes in the threat profile. Organizations using the “R Transtics” brand should educate users about the spoofed page and enforce multi‑factor authentication to mitigate credential theft.