newmail[.]goteal[.]io

Analysis of newmail.goteal.io as of July 25, 2026 shows that the domain is currently offline, indicating that the hosting endpoint has been taken down or is otherwise unreachable. The domain resolves to the IPv4 address 52.44.87.47, which belongs to Amazon Web Services in the us-east-1 region of the United States. The hosting provider is an AWS EC2 instance, a common infrastructure choice for malicious operators because of rapid provisioning and anonymity. The domain was registered on June 28, 2016 through GoDaddy.com, LLC and uses the nameservers pdns03.domaincontrol.com and pdns04.domaincontrol.com, both of which are standard GoDaddy DNS services.

The TLS certificate presented for the site is issued by Amazon, offering a valid HTTPS connection but providing no assurance of legitimacy. VirusTotal records indicate that 16 out of 94 scanned security vendors flagged the domain, reflecting a moderate detection rate among scanners. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing service recognized it as malicious. The known scam type is credential phishing, suggesting that the site, when active, was intended to harvest user credentials.

No public Safe Browsing verdict, Open Threat Exchange entry, or page title information is available for this domain, and no additional evidence links have been published. Given the observed infrastructure, the presence on a blocklist, and the vendor detections, defenders should continue to deny traffic to 52.44.87.47, add newmail.goteal.io to local deny lists, and monitor for any re‑registration or resurrection of the domain. Network sensors should flag outbound connections to the associated AWS IP range, and email gateways should enforce strict URL filtering for any links containing the “newmail.goteal.io” host.