molteacas82[.]com

PhishDestroy analysts have identified the domain molteacas82.com as a generic phishing host currently under active investigation for delivering counterfeit login portals designed to harvest user credentials. The domain is flagged by 5 of 95 VirusTotal vendors as of seed c98502, indicating it remains undetected by most antivirus engines despite its malicious intent. It is registered through GMO Internet, Inc., resolves to IP 172.67.170.71, and holds a valid Let’s Encrypt SSL certificate, lending it a false appearance of legitimacy. The domain molteacas82.com was created on February 28, 2026, and currently shows no detections on VirusTotal, which may reflect its newness or evasion tactics employed by the threat actor. The hosting infrastructure (IP 172.67.170.71) is associated with Cloudflare, a common service used to mask true server locations and complicate takedown efforts. While blocklist data and trust scores are not yet available due to its recent emergence, the combination of a newly registered domain, SSL certificate procurement, and hosting on a reputable CDN suggests preparation for a sustained phishing campaign. The absence of detections underscores the importance of behavioral and heuristic analysis in identifying emerging threats. Current status: The domain remains active and poses a high risk despite zero VirusTotal detections. Users are strongly advised to avoid interacting with any login prompts or forms hosted on molteacas82.com. Organizations should update their threat intelligence feeds, block the domain and IP at the network perimeter, and educate users to verify website authenticity via HTTPS, domain age, and official branding cues. Immediate reporting to cybersecurity teams or platforms like PhishDestroy is critical to prevent credential theft and downstream compromise.