analytical-sigma[.]co[.]za

The domain analytical-sigma.co.za was registered on May 15, 2026 through Afrihost and remains active as of July 12, 2026. It is currently listed on one security blocklist and has been blocked by the PhishDestroy sinkhole. HTTP requests return a 200 status, and the site presents the page title "Analytical Sigma - ICT".

Infrastructure analysis shows the domain resolves to IP address 41.76.208.44, which is hosted in South Africa and owned by Afrihost (Pty) Ltd. Authoritative name servers are ns1.afrihost.com and ns2.afrihost.com. The MX record points to mail.analytical-sigma.co.za with priority 10, indicating a functional mail service. The site serves a Let’s Encrypt R13 TLS certificate and runs on LiteSpeed with HTTP/3 enabled.

Threat indicators include a Gridinsoft trust score of 0 out of 100 and detection by ten of ninety‑five security vendors on VirusTotal, reinforcing the malicious classification. The combination of a legitimate‑looking page title, a low trust score, and active blocking by a phishing mitigation service suggests the domain is being used for credential‑ harvesting or similar generic phishing campaigns. No additional payload details have been observed, leaving the exact phishing vector and targeted victims uncertain.

Defenders should add analytical-sigma.co.za and its resolved IP 41.76.208.44 to outbound and inbound block lists, monitor DNS queries for the associated MX host, and enforce TLS inspection to detect any credential submission. Continuous re‑evaluation of the domain’s status on blocklists and VirusTotal, as well as correlation with user‑reported phishing attempts, will help contain potential compromise attempts.