vumafin[.]co[.]za

Analysis of vumafin.co.za shows a freshly registered domain (created June 07, 2026) that is actively serving content over HTTPS with a Let’s Encrypt R13 certificate. The server responds with HTTP 200 and runs PHP on a LiteSpeed stack supporting HTTP/3. The site resolves to IP 198.251.84.200, which is geolocated to Luxembourg and associated with FranTech Solutions. The page title "Vumafin | Instant Loan Matching Platform – Get Approved in 1 Hour" suggests a loan‑related lure, consistent with the generic_phishing classification. Reputation data is poor, with a Gridinsoft trust score of 38/100 and five of ninety‑one VirusTotal scanners flagging the domain. AlienVault OTX records four threat intelligence pulses referencing the same host, and the domain appears on a single security blocklist. PhishDestroy has already blocked the site, confirming its malicious intent. While the infrastructure details are clear, the exact content and any credential‑harvesting mechanisms have not been examined. Defenders should immediately block traffic to 198.251.84.200, add vumafin.co.za to internal URL filtering lists, and monitor for related indicators such as the Let’s Encrypt certificate fingerprint and LiteSpeed server signatures. Continued observation of OTX and VirusTotal updates is recommended to capture any evolving threat activity.