mhatuminerals[.]africa

Analysis of the domain mhatuminerals.africa indicates active credential phishing infrastructure. Registered on June 11, 2026, through DNS Africa Ltd, the domain resolves to IP 154.0.160.47, hosted on a network in South Africa. As of July 12, 2026, the site returns an HTTP 401 status, suggesting restricted access or a staging phase, while the page title remains 'Loading...'—a common indicator of incomplete or obfuscated phishing deployment. Security vendors have flagged the domain, with 23 of 91 engines detecting malicious activity, and it appears on three blocklists, including PhishDestroy, MetaMask, and SEAL. The domain's SSL certificate, issued by Let's Encrypt (R12), does not mitigate risk, as phishing sites frequently use valid certificates to appear legitimate. Nameservers (ns.dns1.co.za, ns.dns2.co.za, ns.otherdns.com, ns.otherdns.net) are consistent with regional hosting patterns but provide no inherent trust signal. AlienVault OTX records confirm the domain's presence in three threat intelligence pulses, reinforcing its association with malicious campaigns. While the exact brand or service being impersonated remains unconfirmed due to the lack of visible content, the classification as a credential phishing site is supported by vendor detections and infrastructure analysis. Defenders should treat this domain as high-risk, block resolution at the DNS level, and monitor for connections to 154.0.160.47 or related subdomains. Further analysis of payloads or redirect chains is recommended if the site becomes fully operational.