ferryman[.]co[.]za

This domain, ferryman.co.za, was registered on 21 February 2026 and is currently active. It resolves to the Cloudflare‑owned address 104.21.46.13 (ASN 13335) and uses Cloudflare’s authoritative nameservers noel.ns.cloudflare.com and mira.ns.cloudflare.com. The site serves a page titled “Ferryman Collections – Ferryman Collections” and presents a WordPress installation with MySQL, PHP, Slider Revolution, jQuery, and HTTP/3 enabled. The TLS certificate is issued by Google Trust Services under the WE1 chain, providing a valid HTTPS connection. Email routing is handled by mx.stackmail.com (priority 10), a service distinct from the hosting provider, which may be leveraged for credential‑collection activities. The presence of a fully functional WordPress stack indicates the site can host malicious forms or payloads. Reputation data shows the domain is flagged by one of ninety‑five VirusTotal scanners, receives a zero score from Gridinsoft, and appears on a single external blocklist. PhishDestroy has already blocked the domain, confirming its use in a phishing campaign. No public indicators beyond these listings have been released, leaving the exact impersonated brand or lure content uncertain. Defenders should add ferryman.co.za to URL filtering and DNS sinkhole lists, block outbound connections to its IP address, and monitor for traffic to the associated MX host. Email gateways should enforce strict sender verification for messages claiming to originate from ferryman.co.za, and internal scanning for WordPress‑related implants is recommended, as the platform can be abused to host malicious payloads.